Loading...
Skip to main content
GeekWala

CVE-2024-32888 — Vulnerability in...

CRITICAL

Amazon JDBC Driver for Redshift SQL Injection via line comment generation

Published May 15, 2024Updated September 10, 2026Source: osv

Summary

### Impact SQL injection is possible when using the non-default connection property `preferQueryMode=simple` in combination with application code which has a vulnerable SQL that negates a parameter value. There is no vulnerability in the driver when using the default, extended query mode. Note that `preferQueryMode` is not a supported parameter in Redshift JDBC driver, and is inherited code from Postgres JDBC driver. Users who do not override default settings to utilize this unsupported query mode are not affected. ### Patch This issue is patched in driver version 2.1.0.28. ### Workarounds Do not use the connection property `preferQueryMode=simple`. (NOTE: If you do not explicitly specify a query mode, then you are using the default of extended query mode and are not affected by this issue.) ### References Similar to finding in Postgres JDBC: https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-24rp-q3w6-vc56 If you have any questions or comments about this advisory, we ask that you contact AWS Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.

Advisory Timeline

  • First published May 15, 2024 (880 days ago).
  • Last revised September 10, 2026 — 847 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven
Update com.amazon.redshift:redshift-jdbc42 to 2.1.0.28 or later
<!-- Update pom.xml dependency version to 2.1.0.28 for com.amazon.redshift:redshift-jdbc42 -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: maven (1).

PackageEcosystemAffectedFixed In
com.amazon.redshift:redshift-jdbc42
maven
2.0.0.3, 2.0.0.4, 2.0.0.5, 2.0.0.6 (+28 more)2.1.0.28

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 10.0 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2024-32888?
Amazon JDBC Driver for Redshift SQL Injection via line comment generation This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 10.0/10).
How do I check if my project is affected by CVE-2024-32888?
CVE-2024-32888 affects com.amazon.redshift:redshift-jdbc42. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-32888 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
10.0

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-x3wm-hffr-chwm

Related CVEs

More Maven advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies