Vulnerability details
CVE-2025-5279
Amazon Redshift
Issue with Amazon Redshift Python Connector and the BrowserAzureOAuth2CredentialsProvider plugin
CVSS 4.0
7.0High
Official description
When the Amazon Redshift Python Connector is configured with the BrowserAzureOAuth2CredentialsProvider plugin, the driver skips the SSL certificate validation step for the Identity Provider. An insecure connection could allow an actor to intercept the token exchange process and retrieve an access token. This issue has been addressed in driver version 2.1.7. Users should upgrade to address this issue and ensure any forked or derivative code is patched to incorporate the new fixes.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.0High | 4.0 | CVEProject cvelistV5 (CNA) (AMZN) | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Amazon | Redshift | 2.0.872 ≤ v < 2.1.7 | CVEProject cvelistV5 (CNA) |
References and advisories
3
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-05-27
- Last updated
- 2025-10-14
- State
- Published
- Assigner (CNA)
- AMZN
Exploit prediction (EPSS)
0.31%
Probability of exploitation in 30 days
23.9%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-295Improper Certificate Validation