CVE-2024-12744: SQL Injection in the Amazon Redshift JDBC Driver affecting v2.1.0.31

Severity: high (CVSS 8.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-12-24 · updated 2026-06-17
Weakness: CWE-89

Description

A SQL injection in the Amazon Redshift JDBC Driver in v2.1.0.31 allows a user to gain escalated privileges via the getSchemas, getTables, or getColumns Metadata APIs. Users should upgrade to the driver version 2.1.0.32 or revert to driver version 2.1.0.30.

Affected products

Amazon Redshift JDBC Driver: 2.1.0.31

References

https://aws.amazon.com/security/security-bulletins/AWS-2024-015/
https://github.com/aws/amazon-redshift-jdbc-driver/releases/tag/v2.1.0.32
https://github.com/aws/amazon-redshift-jdbc-driver/security/advisories/GHSA-8596-2jgr-ppj7

Get alerted when CVE-2024-12744 or the next vulnerability affects your stack