← Volver a CVEs

CVE-2026-35560

HIGH

7.4

Descripcion

Improper certificate validation in the identity provider connection components in Amazon Athena ODBC driver before 2.1.0.0 might allow a man-in-the-middle threat actor to intercept authentication credentials due to insufficient default transport security when connecting to identity providers. This only applies to connections with external identity providers and does not apply to connections with Athena. To remediate this issue, users should upgrade to version 2.1.0.0.

Detalles CVE

Puntuacion CVSS v3.17.4

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Vector de ataqueNETWORK

ComplejidadHIGH

Privilegios requeridosNONE

Interaccion usuarioNONE

Publicado4/3/2026

Ultima modificacion4/3/2026

Fuentenvd

Avistamientos honeypot0

Debilidades (CWE)

CWE-295

Referencias

https://aws.amazon.com/security/security-bulletins/2026-013-aws/(ff89ba41-3aa1-4d27-914a-91399e9639e5)

https://docs.aws.amazon.com/athena/latest/ug/odbc-v2-driver-release-notes.html(ff89ba41-3aa1-4d27-914a-91399e9639e5)

https://downloads.athena.us-east-1.amazonaws.com/drivers/ODBC/v2.1.0.0/Linux/AmazonAthenaODBC-2.1.0.0.rpm(ff89ba41-3aa1-4d27-914a-91399e9639e5)

https://downloads.athena.us-east-1.amazonaws.com/drivers/ODBC/v2.1.0.0/Mac/Intel/AmazonAthenaODBC-2.1.0.0_x86.pkg(ff89ba41-3aa1-4d27-914a-91399e9639e5)

https://downloads.athena.us-east-1.amazonaws.com/drivers/ODBC/v2.1.0.0/Mac/arm/AmazonAthenaODBC-2.1.0.0_arm.pkg(ff89ba41-3aa1-4d27-914a-91399e9639e5)

https://downloads.athena.us-east-1.amazonaws.com/drivers/ODBC/v2.1.0.0/Windows/AmazonAthenaODBC-2.1.0.0.msi(ff89ba41-3aa1-4d27-914a-91399e9639e5)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.