Unverified ownership of the default Athena query result location in AWS SDK for pandas
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 3.16.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The AWS SDK for pandas (awswrangler) Python library's Athena module is affected, specifically its default query result location handling. An attacker could potentially read Athena query results or alter the result data returned to the calling application, because the default S3 result bucket may not be verified as owned by the user's own account.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Unverified ownership of the default query result location in the Athena module in AWS SDK for pandas (awswrangler) before 3.16.1 might allow remote actors to read Athena query results and tamper with result sets returned to the caller via a pre-created S3 bucket. To remediate this issue, users should upgrade to version 3.16.1 or later. Users should also verify that the default Athena result bucket in each account and region is owned by their own account, and set an explicit result location or enforce a workgroup result configuration.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- aws aws-sdk-pandas
fixed in 3.16.1