CVE-2024-32888

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

The Amazon JDBC Driver for Redshift is a Type 4 JDBC driver that provides database connectivity through the standard JDBC application program interfaces (APIs) available in the Java Platform, Enterprise Editions. Prior to version 2.1.0.28, SQL injection is possible when using the non-default connection property `preferQueryMode=simple` in combination with application code which has a vulnerable SQL that negates a parameter value. There is no vulnerability in the driver when using the default, extended query mode. Note that `preferQueryMode` is not a supported parameter in Redshift JDBC driver, and is inherited code from Postgres JDBC driver. Users who do not override default settings to utilize this unsupported query mode are not affected. This issue is patched in driver version 2.1.0.28. As a workaround, do not use the connection property `preferQueryMode=simple`. (NOTE: Those who do not explicitly specify a query mode use the default of extended query mode and are not affected by this issue.)

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
May 15, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-32897.8When installing Nessus to a directory outside of the default location on a Windows host, Nessus versions prior to 10.7.3 did not enforce secCVE-2024-328906.1librespeed/speedtest is an open source, self-hosted speed test for HTML5. In affected versions missing neutralization of the ISP informationCVE-2024-328917.0In sec_media_unprotect of media.c, there is a possible memory corruption due to a race condition. This could lead to local escalation of priCVE-2024-328927.8In handle_init of goodix/main/main.c, there is a possible memory corruption due to type confusion. This could lead to local escalation of prCVE-2024-328935.5In _s5e9865_mif_set_rate of exynos_dvfs.c, there is a possible out of bounds read due to improper casting. This could lead to local informatCVE-2024-328947.5In bc_get_converted_received_bearer of bc_utilities.c, there is a possible out of bounds read due to a missing bounds check. This could leadCVE-2024-328957.8In BCMFASTPATH of dhd_msgbuf.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation oCVE-2024-328967.8there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional exeCVE-2024-328975.9In ProtocolCdmaCallWaitingIndAdapter::GetCwInfo() of protocolsmsadapter.cpp, there is a possible out of bounds read due to a missing bounds CVE-2024-328984.7In ProtocolCellIdentityParserV4::Parse() of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check. ThCVE-2024-328997.0In gpu_pm_power_off_top_nolock of pixel_gpu_power.c, there is a possible compromise of protected memory due to a race condition. This could CVE-2024-32908.2A race condition vulnerability exists where an authenticated, local attacker on a Windows Nessus host could modify installation parameters a