Read the docs
TI-2024-21759 Aliases CVE-2024-32888GHSA-x3wm-hffr-chwm

Amazon JDBC Driver for Redshift SQL Injection via line comment generation

Priority MEDIUM 50CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

The Amazon JDBC Driver for Redshift is a Type 4 JDBC driver that provides database connectivity through the standard JDBC application program interfaces (APIs) available in the Java Platform, Enterprise Editions. Prior to version 2.1.0.28, SQL injection is possible when using the non-default connection property `preferQueryMode=simple` in combination with application code which has a vulnerable SQL that negates a parameter value. There is no vulnerability in the driver when using the default, extended query mode. Note that `preferQueryMode` is not a supported parameter in Redshift JDBC driver, and is inherited code from Postgres JDBC driver. Users who do not override default settings to utilize this unsupported query mode are not affected. This issue is patched in driver version 2.1.0.28. As a workaround, do not use the connection property `preferQueryMode=simple`. (NOTE: Those who do not explicitly specify a query mode use the default of extended query mode and are not affected by this issue.)

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00778 56th percentileScored 2026-11-07
Fix Fixed amazon-redshift-jdbc-driver (aws): 2.1.0.28com.amazon.redshift:redshift-jdbc42 (Maven): 2.1.0.28

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AWSamazon-redshift-jdbc-driverbefore 2.1.0.282.1.0.28Patch availableCNA
—com.amazon.redshift:redshift-jdbc42 (Maven)before 2.1.0.282.1.0.28Patch availableGHSA-x3wm-hffr-chwm
  • amazon-redshift-jdbc-driver VendorAWS Affected before 2.1.0.28 Fixed in 2.1.0.28 Patch available CNA
  • com.amazon.redshift:redshift-jdbc42 (Maven) Vendor— Affected before 2.1.0.28 Fixed in 2.1.0.28 Patch available GHSA-x3wm-hffr-chwm

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:aws:amazon-redshift-jdbc-driver:-:*:*:*:*:*:*:*not specified by CISA-ADP——
  • cpe:2.3:a:aws:amazon-redshift-jdbc-driver:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·—

Remediation

  • Fix · CNA amazon-redshift-jdbc-driver (aws) Fixed in 2.1.0.28
  • Fix · GHSA-x3wm-hffr-chwm com.amazon.redshift:redshift-jdbc42 (Maven) Fixed in 2.1.0.28 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-32888
  2. 2026-10-03 Alias added: GHSA-x3wm-hffr-chwm

References

Advisory 1

Other 7

  • TI-2026-23989 crypto: algif_aead - Revert to operating out-of-place KEVCVSS 3.1HIGH 7.8
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2024-18648 Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM… CVSS 3.1CRITICAL 9.8
  • TI-2024-05929 Openssh: regresshion - race condition in ssh allows rce/dos CVSS 3.1HIGH 8.1
  • TI-2025-03847 Input validation issue in AWS Amplify Studio UI component properties CVSS 4.0CRITICAL 9.0
  • TI-2026-11603 HTTP/2 Stream Parser Confusion Body-Inspection Bypass in Amazon CloudFront with AWS WAF CVSS 4.0HIGH 7.9
See all 383 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences