GitHub Advisoryadvisory · PyPI

GHSA-r244-wg5g-6w2r Issue with Amazon Redshift Python Connector and the BrowserAzureOAuth2CredentialsProvider plugin

HIGH Published 2025-05-28 Modified 2025-10-14 Official page ↗
Aliases
CVE-2025-5279
Ecosystem
PyPI
Packages
redshift-connector
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-295
Reviewed
2025-05-28

Affected packages

• PyPI redshift-connector: >= 2.0.872, < 2.1.7 → fixed in 2.1.7

Description

Summary Amazon Redshift Python Connector is a pure Python connector to Redshift (i.e., driver) that implements the Python Database API Specification 2.0. When the Amazon Redshift Python Connector is configured with the BrowserAzureOAuth2CredentialsProvider plugin, the driver skips the SSL certificate validation step for the Identity Provider. Impact An insecure connection could allow an actor to intercept the token exchange process and retrieve an access token. Impacted versions: >=2.0.872;<=2.1.6 Patches Upgrade Amazon Redshift Python Connector to version 2.1.7 and ensure any forked or derivative code is patched to incorporate the new fixes. Workarounds None References If you have any questions or comments about this advisory we ask that you contact AWS/Amazon Security via our vulnerability reporting page [1] or directly via email to [email protected]. Please do not create a public GitHub issue. [1] Vulnerability reporting page: https://aws.amazon.com/security/vulnerability-reporting

Related

Alias · CVE (1)

  • CVE-2025-5279 When the Amazon Redshift Python Connector is configured with the BrowserAzureOAuth2CredentialsProvider plugin, the driver skips the SSL… vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References