CVE-2024-12744 SQL Injection in the Amazon Redshift JDBC Driver affecting v2.1.0.31
A SQL injection vulnerability in the Amazon Redshift JDBC Driver allows attackers to escalate privileges via metadata APIs, requiring an upgrade to the latest version.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-12744?
CVE-2024-12744 is a high-severity SQL injection vulnerability in Amazon Redshift JDBC Driver, published on 24 Dec 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A SQL injection in the Amazon Redshift JDBC Driver in v2.1.0.31 allows a user to gain escalated privileges via the getSchemas, getTables, or getColumns Metadata APIs. Users should upgrade to the driver version 2.1.0.32 or revert to driver version 2.1.0.30.
Weakness: CWE-89
Which versions are affected by CVE-2024-12744?
2 open source packages ship an affected version, including com.amazon.redshift:redshift-jdbc42. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.amazon.redshift:redshift-jdbc42 Maven | From 2.1.0.31 | 2.1.0.32 |
com.amazon.redshift:redshift-jdbc42 Maven | From 2.1.0.31 | 2.1.0.32 |
Products include Amazon Amazon Web Services Redshift Java Database Connectivity Driver.
How do I fix CVE-2024-12744?
Upgrade com.amazon.redshift:redshift-jdbc42 to 2.1.0.32 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2024-12744 being exploited?
There is no known exploitation of CVE-2024-12744 in the wild and no public exploit code.
Other vulnerabilities in Amazon Redshift JDBC Driver
Sources
Also known as GHSA-8596-2jgr-ppj7.