Vulnerability	Vulnerable Version
H Arbitrary Code Injection redshift-connector is a Redshift interface library Affected versions of this package are vulnerable to Arbitrary Code Injection due to the use of `eval()` on untrusted data received from the server, in the `vector_in()` function. An attacker can execute arbitrary code on the client system by sending malicious query responses. If the attacker is in a MitM position, it lowers the likelihood of a successful attack (CVSS AT:P). But an attacker on the internet in control of a rogue server who can convince a client to send requests to it is also able to exploit this vulnerability, so it is assessed here as AV:N with UI:P. How to fix Arbitrary Code Injection? Upgrade `redshift-connector` to version 2.1.14 or higher.	[,2.1.14)

Arbitrary Code Injection

redshift-connector is a Redshift interface library

Affected versions of this package are vulnerable to Arbitrary Code Injection due to the use of eval() on untrusted data received from the server, in the vector_in() function. An attacker can execute arbitrary code on the client system by sending malicious query responses.

If the attacker is in a MitM position, it lowers the likelihood of a successful attack (CVSS AT:P). But an attacker on the internet in control of a rogue server who can convince a client to send requests to it is also able to exploit this vulnerability, so it is assessed here as AV:N with UI:P.

How to fix Arbitrary Code Injection?

Upgrade redshift-connector to version 2.1.14 or higher.

[,2.1.14)

Go back to all versions of this package