GHSA-29H4-R29X-HCHV严重已审查

amazon-redshift-python-driver vulnerable to Remote Code Execution via eval() Injection

OSV 1.4.0 · github-reviewed · 修改于 2026-06-03 05:41

发布时间

2026-05-30 03:32

GitHub 审查时间

2026-05-30 03:32

NVD 发布时间

2026-05-19 05:16

源文件

advisories/github-reviewed/2026/05/GHSA-29h4-r29x-hchv/GHSA-29h4-r29x-hchv.json

公告说明

Summary

amazon-redshift-python-driver is the official Python connector for Amazon Redshift. In versions 2.1.13 and earlier, the driver insufficiently validates data received from the server during query result processing. A rogue server or man-in-the-middle could leverage this to execute arbitrary code on the client.

Impact

When a client connects to a rogue server implementing the PostgreSQL wire protocol, the server can send specially crafted query responses that the driver processes without adequate input validation. This could result in arbitrary code execution in the client process, potentially enabling command execution, file system access, or credential theft with the privileges of the client application.

Impacted versions: <=2.1.13

Patches

This has been addressed in amazon-redshift-python-driver version 2.1.14 (https://github.com/aws/amazon-redshift-python-driver/releases/tag/v2.1.14). Amazon Redshift recommends upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

References

If there are any questions or comments about this advisory, contact AWS Security via the issue reporting page or directly via email to [email protected]. Please do not create a public GitHub issue.

Acknowledgement

Amazon Redshift would like to thank Kexin Chen (@ckx-sec) for collaborating through the coordinated disclosure process.

受影响的软件包

标识信息

别名 / CVE

CVE-2026-8838

CWE

CWE-94

软件生态

PyPI

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS_V4

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

原始 OSV JSON

{
  "id": "GHSA-29h4-r29x-hchv",
  "aliases": [
    "CVE-2026-8838"
  ],
  "details": "### Summary\namazon-redshift-python-driver is the official Python connector for Amazon Redshift. In versions 2.1.13 and earlier, the driver insufficiently validates data received from the server during query result processing. A rogue server or man-in-the-middle could leverage this to execute arbitrary code on the client.\n\n### Impact\nWhen a client connects to a rogue server implementing the PostgreSQL wire protocol, the server can send specially crafted query responses that the driver processes without adequate input validation. This could result in arbitrary code execution in the client process, potentially enabling command execution, file system access, or credential theft with the privileges of the client application.\n\nImpacted versions: <=2.1.13\n\n### Patches\nThis has been addressed in amazon-redshift-python-driver version 2.1.14 (https://github.com/aws/amazon-redshift-python-driver/releases/tag/v2.1.14). Amazon Redshift recommends upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\n### References\nIf there are any questions or comments about this advisory, contact AWS Security via the issue reporting page or directly via email to [email protected]. Please do not create a public GitHub issue.\n\n### Acknowledgement\nAmazon Redshift would like to thank Kexin Chen (@ckx-sec) for collaborating through the coordinated disclosure process.",
  "summary": "amazon-redshift-python-driver vulnerable to Remote Code Execution via eval() Injection",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.14"
            }
          ]
        }
      ],
      "package": {
        "name": "redshift-connector",
        "ecosystem": "PyPI"
      },
      "database_specific": {
        "last_known_affected_version_range": "<= 2.1.13"
      }
    }
  ],
  "modified": "2026-06-02T21:41:29Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    },
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
    }
  ],
  "published": "2026-05-29T19:32:28Z",
  "references": [
    {
      "url": "https://github.com/aws/amazon-redshift-python-driver/security/advisories/GHSA-29h4-r29x-hchv",
      "type": "WEB"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8838",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/aws/amazon-redshift-python-driver/commit/69a69dfdead75918e20384da52bcd760ded8dbca",
      "type": "WEB"
    },
    {
      "url": "https://aws.amazon.com/security/security-bulletins/2026-033-aws",
      "type": "WEB"
    },
    {
      "url": "https://github.com/aws/amazon-redshift-python-driver",
      "type": "PACKAGE"
    },
    {
      "url": "https://github.com/aws/amazon-redshift-python-driver/releases/tag/v2.1.14",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "nvd_published_at": "2026-05-18T21:16:41Z",
    "github_reviewed_at": "2026-05-29T19:32:28Z"
  }
}