CVE-2024-32888

The Amazon JDBC Driver for Redshift is a Type 4 JDBC driver that provides database connectivity through the standard JDBC application program interfaces (APIs) available in the Java Platform, Enterprise Editions. Prior to version 2.1.0.28, SQL injection is possible when using the non-default connection property `preferQueryMode=simple` in combination with application code which has a vulnerable SQL that negates a parameter value. There is no vulnerability in the driver when using the default, extended query mode. Note that `preferQueryMode` is not a supported parameter in Redshift JDBC driver, and is inherited code from Postgres JDBC driver. Users who do not override default settings to utilize this unsupported query mode are not affected. This issue is patched in driver version 2.1.0.28. As a workaround, do not use the connection property `preferQueryMode=simple`. (NOTE: Those who do not explicitly specify a query mode use the default of extended query mode and are not affected by this issue.)

• CWE-89

• https://github.com/aws/amazon-redshift-jdbc-driver/commit/0d354a5f26ca23f7cac4e800e3b8734220230319
• https://github.com/aws/amazon-redshift-jdbc-driver/commit/12a5e8ecfbb44c8154fc66041cca2e20ecd7b339
• https://github.com/aws/amazon-redshift-jdbc-driver/commit/bc93694201a291493778ce5369a72befeca5ba7d
• https://github.com/aws/amazon-redshift-jdbc-driver/security/advisories/GHSA-x3wm-hffr-chwm
• https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-24rp-q3w6-vc56
• https://github.com/aws/amazon-redshift-jdbc-driver/commit/0d354a5f26ca23f7cac4e800e3b8734220230319
• https://github.com/aws/amazon-redshift-jdbc-driver/commit/12a5e8ecfbb44c8154fc66041cca2e20ecd7b339
• https://github.com/aws/amazon-redshift-jdbc-driver/commit/bc93694201a291493778ce5369a72befeca5ba7d
• https://github.com/aws/amazon-redshift-jdbc-driver/security/advisories/GHSA-x3wm-hffr-chwm
• https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-24rp-q3w6-vc56
• https://www.sonarsource.com/blog/double-dash-double-trouble-a-subtle-sql-injection-flaw/

Published

May 15, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-32881Danswer is the AI Assistant connected to company's docs, app…9.8
• CVE-2024-32882Wagtail is an open source content management system built on…2.7
• CVE-2024-32883MCUboot is a secure bootloader for 32-bits microcontrollers.…7.7
• CVE-2024-32884gitoxide is a pure Rust implementation of Git. `gix-transpor…6.4
• CVE-2024-32886Vitess is a database clustering system for horizontal scalin…4.9
• CVE-2024-32887Sidekiq is simple, efficient background processing for Ruby.…5.5
• CVE-2024-3289When installing Nessus to a directory outside of the default…7.8
• CVE-2024-32890librespeed/speedtest is an open source, self-hosted speed te…6.1
• CVE-2024-32891In sec_media_unprotect of media.c, there is a possible memor…7
• CVE-2024-32892In handle_init of goodix/main/main.c, there is a possible me…7.8
• CVE-2024-32893In _s5e9865_mif_set_rate of exynos_dvfs.c, there is a possib…5.5
• CVE-2024-32894In bc_get_converted_received_bearer of bc_utilities.c, there…7.5