https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 19:50:03 +0000 https://db.gcve.eu/vuln/ghsa-r244-wg5g-6w2r <p><strong>Affected:</strong> PyPI: redshift-connector</p> <p>### Summary [Amazon Redshift Python Connector](https://docs.aws.amazon.com/redshift/latest/mgmt/python-redshift-driver.html) is a pure Python connector to Redshift (i.e., driver) that implements the [Python Database API Specification 2.0](https://www.python.org/dev/peps/pep-0249/).</p> <p>When the Amazon Redshift Python Connector is configured with the BrowserAzureOAuth2CredentialsProvider plugin, the driver skips the SSL certificate validation step for the Identity Provider.</p> <p>### Impact</p> <p>An insecure connection could allow an actor to intercept the token exchange process and retrieve an access token.</p> <p>**Impacted versions:** &gt;=2.0.872;&lt;=2.1.6</p> <p>### Patches</p> <p>Upgrade Amazon Redshift Python Connector to version 2.1.7 and ensure any forked or derivative code is patched to incorporate the new fixes.</p> <p>### Workarounds</p> <p>None</p> <p>### References</p> <p>If you have any questions or comments about this advisory we ask that you contact AWS/Amazon Security via our vulnerability reporting page [1] or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.</p> <p>[1] Vulnerability reporting page: https://aws.amazon.com/security/vulnerability-reporting</p> <p><strong>Affected:</strong> PyPI: redshift-connector</p> <p>### Summary [Amazon Redshift Python Connector](https://docs.aws.amazon.com/redshift/latest/mgmt/python-redshift-driver.html) is a pure Python connector to Redshift (i.e., driver) that implements the [Python Database API Specification 2.0](https://www.python.org/dev/peps/pep-0249/).</p> <p>When the Amazon Redshift Python Connector is configured with the BrowserAzureOAuth2CredentialsProvider plugin, the driver skips the SSL certificate validation step for the Identity Provider.</p> <p>### Impact</p> <p>An insecure connection could allow an actor to intercept the token exchange process and retrieve an access token.</p> <p>**Impacted versions:** &gt;=2.0.872;&lt;=2.1.6</p> <p>### Patches</p> <p>Upgrade Amazon Redshift Python Connector to version 2.1.7 and ensure any forked or derivative code is patched to incorporate the new fixes.</p> <p>### Workarounds</p> <p>None</p> <p>### References</p> <p>If you have any questions or comments about this advisory we ask that you contact AWS/Amazon Security via our vulnerability reporting page [1] or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.</p> <p>[1] Vulnerability reporting page: https://aws.amazon.com/security/vulnerability-reporting</p> https://db.gcve.eu/vuln/ghsa-r244-wg5g-6w2r