Homepage

CVE-2024-32888 Affecting trino package, versions <472-r0

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.48% (66th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-WOLFILATEST-TRINO-15418963
  • published5 Mar 2026
  • disclosed15 May 2024
Report a new vulnerability Found a mistake?

Introduced: 15 May 2024

CVE-2024-32888  (opens in a new tab)

How to fix?

Upgrade Wolfi trino to version 472-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream trino package and not the trino package as distributed by Wolfi. See How to fix? for Wolfi relevant fixed versions and status.

The Amazon JDBC Driver for Redshift is a Type 4 JDBC driver that provides database connectivity through the standard JDBC application program interfaces (APIs) available in the Java Platform, Enterprise Editions. Prior to version 2.1.0.28, SQL injection is possible when using the non-default connection property preferQueryMode=simple in combination with application code which has a vulnerable SQL that negates a parameter value. There is no vulnerability in the driver when using the default, extended query mode. Note that preferQueryMode is not a supported parameter in Redshift JDBC driver, and is inherited code from Postgres JDBC driver. Users who do not override default settings to utilize this unsupported query mode are not affected. This issue is patched in driver version 2.1.0.28. As a workaround, do not use the connection property preferQueryMode=simple. (NOTE: Those who do not explicitly specify a query mode use the default of extended query mode and are not affected by this issue.)