CVE-2025-5279highCWE-295

CVE-2025-5279: falha de alta gravidade em Amazon Redshift

Issue with Amazon Redshift Python Connector and the BrowserAzureOAuth2CredentialsProvider plugin

Publicada em 27 mai 2025 · Atualizada em 14 out 2025

Seguir esta CVE + Monitorar Redshift + Monitorar redshift-connector

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7epss 0.3%

When the Amazon Redshift Python Connector is configured with the BrowserAzureOAuth2CredentialsProvider plugin, the driver skips the SSL certificate validation step for the Identity Provider. An insecure connection could allow an actor to intercept the token exchange process and retrieve an access token. This issue has been addressed in driver version 2.1.7. Users should upgrade to address this issue and ensure any forked or derivative code is patched to incorporate the new fixes.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Produtos afetados

Amazon · Redshift

Referências

https://aws.amazon.com/security/security-bulletins/AWS-2025-011/https://github.com/aws/amazon-redshift-python-driver/releases/tag/v2.1.7 https://github.com/aws/amazon-redshift-python-driver/security/advisories/GHSA-r244-wg5g-6w2r