CVE-2024-12745 SQL Injection in the Amazon Redshift Python Connector affecting v2.1.4
SQL injection in Amazon Redshift Python Connector allows privilege escalation via metadata APIs; users should upgrade the driver.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-12745?
CVE-2024-12745 is a high-severity SQL injection vulnerability in Amazon Redshift Python Connector, published on 24 Dec 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A SQL injection in the Amazon Redshift Python Connector v2.1.4 allows a user to gain escalated privileges via the get_schemas, get_tables, or get_columns Metadata APIs. Users are recommended to upgrade to the driver version 2.1.5 or revert to driver version 2.1.3.
Weakness: CWE-89
Which versions are affected by CVE-2024-12745?
3 open source packages ship an affected version, including redshift-connector and redshift_connector. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
redshift-connector PyPI | From 2.1.4 | 2.1.5 |
redshift-connector PyPI | From 2.1.4 | 2.1.5 |
redshift_connector PyPI | From 2.1.4 | 2.1.5 |
Products include Amazon Redshift Connector.
How do I fix CVE-2024-12745?
Upgrade redshift-connector to 2.1.5 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2024-12745 being exploited?
There is no known exploitation of CVE-2024-12745 in the wild and no public exploit code.
Sources
Also known as GHSA-8gc2-vq6m-rwjw, PYSEC-2026-1866.