Bug 2280576 (CVE-2024-32888) - CVE-2024-32888 redshift: vulnerable to SQL injection that negates a parameter value
Summary: CVE-2024-32888 redshift: vulnerable to SQL injection that negates a parameter...
Status: NEW
Alias: CVE-2024-32888
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Product Security
QA Contact:
Depends On: 2280577 2280578
TreeView+ depends on / blocked
Reported: 2024-05-15 08:24 UTC by Rohit Keshri
Modified: 2024-05-15 08:25 UTC (History)
0 users

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed:

Attachments (Terms of Use)

Description Rohit Keshri 2024-05-15 08:24:26 UTC
The Amazon JDBC Driver for Redshift is a Type 4 JDBC driver that provides database connectivity through the standard JDBC application program interfaces (APIs) available in the Java Platform, Enterprise Editions. Prior to version, SQL injection is possible when using the non-default connection property `preferQueryMode=simple` in combination with application code which has a vulnerable SQL that negates a parameter value. There is no vulnerability in the driver when using the default, extended query mode. Note that `preferQueryMode` is not a supported parameter in Redshift JDBC driver, and is inherited code from Postgres JDBC driver. Users who do not override default settings to utilize this unsupported query mode are not affected. This issue is patched in driver version As a workaround, do not use the connection property `preferQueryMode=simple`. (NOTE: Those who do not explicitly specify a query mode use the default of extended query mode and are not affected by this issue.)


Comment 1 Rohit Keshri 2024-05-15 08:24:48 UTC
Created redshift tracking bugs for this issue:

Affects: epel-all [bug 2280577]
Affects: fedora-all [bug 2280578]

Note You need to log in before you can comment on or make changes to this bug.