Skip to content

[Aikido] Fix critical issue in redshift-connector via minor version upgrade from 2.1.5 to 2.1.14 - #13

Open
aikido-autofix[bot] wants to merge 1 commit into
mainfrom
fix/aikido-security-update-packages-54375965-4ay4
Open

aikido-autofix[bot] wants to merge 1 commit into
mainfrom
fix/aikido-security-update-packages-54375965-4ay4

Conversation

@aikido-autofix

Copy link
Copy Markdown

Upgrade redshift-connector to fix critical remote code execution vulnerability allowing arbitrary code execution via unsafe eval() on server data.

⚠️ Breaking changes in this upgrade

All breaking changes by upgrading redshift-connector from version 2.1.5 to 2.1.14 (CHANGELOG)

Version Description
2.1.7
Modified connection parameter ssl_insecure to be False by default
2.1.9
Removed unsupported client/stdin COPY protocol implementation that was no longer maintained or supported
2.1.13
Raised minimum supported Python version from 3.6 to 3.7
2.1.14
Raised minimum supported Python version from 3.7 to 3.8
✅ 1 CVE resolved by this upgrade, including 1 critical 🚨 CVE

This PR will resolve the following CVEs:

Issue Severity           Description
CVE-2026-8838
🚨 CRITICAL
[redshift-connector] The vector_in() function unsafely uses Python's eval() on server-received data, allowing a rogue server or man-in-the-middle attacker to execute arbitrary code on the client.

@aikido-autofix
aikido-autofix Bot requested a review from a team as a code owner June 23, 2026 18:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants