7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-5279

CVE-2025-5279: Issue with Amazon Redshift Python Connector and the BrowserAzureOAuth2CredentialsProvider plugin

Summary

Amazon Redshift Python Connector is a pure Python connector to Redshift (i.e., driver) that implements the Python Database API Specification 2.0.

When the Amazon Redshift Python Connector is configured with the BrowserAzureOAuth2CredentialsProvider plugin, the driver skips the SSL certificate validation step for the Identity Provider.

Impact

An insecure connection could allow an actor to intercept the token exchange process and retrieve an access token.

Impacted versions: >=2.0.872;<=2.1.6

Patches

Upgrade Amazon Redshift Python Connector to version 2.1.7 and ensure any forked or derivative code is patched to incorporate the new fixes.

Workarounds

None

References

If you have any questions or comments about this advisory we ask that you contact AWS/Amazon Security via our vulnerability reporting page [1] or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.

[1] Vulnerability reporting page: https://aws.amazon.com/security/vulnerability-reporting

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-5279

CVE-2025-5279:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
redshift-connector	pip	>= 2.0.872, <= 2.1.6	2.1.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability (CVE-2025-5279 / GHSA-r244-wg5g-6w2r) in the Amazon Redshift Python Connector was due to insecure default handling of SSL certificate validation for Identity Providers (IdPs). The core issue originated in the RedshiftProperty class, where the ssl_insecure parameter defaulted to True. The intended meaning of ssl_insecure=True, as clarified by the patch's documentation updates, was to disable SSL certificate verification against the IdP.

Consequently, when using IdP-based authentication plugins like BrowserAzureOAuth2CredentialsProvider (explicitly mentioned in the advisory), JwtCredentialsProvider, or SamlCredentialsProvider (implied by test additions in the patch), these plugins would inherit or use this ssl_insecure=True setting. Methods within these providers responsible for fetching tokens or assertions from the IdP would then make HTTPS requests without verifying the IdP's SSL certificate. This lack of validation exposed the token exchange process to man-in-the-middle (MitM) attacks, allowing an attacker to potentially intercept access tokens.

The patch addresses this by:

Changing the default value of ssl_insecure in redshift_connector.redshift_property.RedshiftProperty.__init__ from True to False. This makes SSL certificate verification for IdPs enabled by default.
Adjusting the logic in helper methods like redshift_connector.plugin.jwt_credentials_provider.JwtCredentialsProvider.do_verify_ssl_cert to correctly interpret the ssl_insecure flag (i.e., do_verify_ssl_cert should return True if verification is to be done, which corresponds to ssl_insecure being False).

The functions listed as vulnerable are either responsible for setting the insecure default (RedshiftProperty.__init__) or are the components that would act on this default to perform the insecure IdP communication (BrowserAzureOAuth2CredentialsProvider's token exchange method, and similar methods in other affected providers like JwtCredentialsProvider). During exploitation, a runtime profile would likely show activity within the specific credential provider's method that makes the unverified HTTPS call to the IdP.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

7.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-5279: Issue with Amazon Redshift Python Connector and the BrowserAzureOAuth2CredentialsProvider plugin

Summary

Impact

Patches

Workarounds

References

CVE-2025-5279:

7.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

7.5

7.5

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

CVE-2025-5279: Issue with Amazon Redshift Python Connector and the BrowserAzureOAuth2CredentialsProvider plugin

Summary

Impact

Patches

Workarounds

References

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI