Aws Sdk Pandas
Monthly
Unverified ownership of the default Athena query result location in AWS SDK for pandas (awswrangler) before 3.16.1 allows a remote actor to read Athena query results and tamper with the result set returned to the caller by pre-creating (squatting) the S3 bucket that awswrangler falls back to when no explicit result location is configured. Only deployments that use the Athena module with the default result location - no explicit s3_output and no workgroup result configuration enforced - and whose default result bucket in that account and region is not already owned by them are exposed; the victim must also actively execute a query through the SDK, and the bucket must be unclaimed in that specific account/region combination. This is a moderate-severity, condition-dependent information-disclosure and tampering flaw rather than an emergency; no public exploit was identified at time of analysis and there is no CISA KEV confirmation of active exploitation, and a vendor fix is available in 3.16.1.
Unverified ownership of the default Athena query result location in AWS SDK for pandas (awswrangler) before 3.16.1 allows a remote actor to read Athena query results and tamper with the result set returned to the caller by pre-creating (squatting) the S3 bucket that awswrangler falls back to when no explicit result location is configured. Only deployments that use the Athena module with the default result location - no explicit s3_output and no workgroup result configuration enforced - and whose default result bucket in that account and region is not already owned by them are exposed; the victim must also actively execute a query through the SDK, and the bucket must be unclaimed in that specific account/region combination. This is a moderate-severity, condition-dependent information-disclosure and tampering flaw rather than an emergency; no public exploit was identified at time of analysis and there is no CISA KEV confirmation of active exploitation, and a vendor fix is available in 3.16.1.