AWS athena high security documentation change
Summary
Added release notes for ODBC driver version 2.1.0.0 with detailed security improvements, breaking changes, and fixes
Security assessment
The change explicitly documents multiple security vulnerabilities that were fixed: improper neutralization of special elements (code execution/authentication flow redirection), improper certificate validation, missing authentication security controls, and uncontrolled resource consumption (DoS via crafted inputs). The release notes state these are security improvements and fixes for specific vulnerabilities.
Diff
diff --git a/athena/latest/ug/odbc-v2-driver-release-notes.md b/athena/latest/ug/odbc-v2-driver-release-notes.md index 2fe26570d..e6334c6d2 100644 --- a//athena/latest/ug/odbc-v2-driver-release-notes.md +++ b//athena/latest/ug/odbc-v2-driver-release-notes.md @@ -5 +5 @@ -2.0.6.02.0.5.12.0.5.02.0.4.02.0.3.02.0.2.22.0.2.12.0.2.02.0.1.12.0.1.0 +2.1.0.02.0.6.02.0.5.12.0.5.02.0.4.02.0.3.02.0.2.22.0.2.12.0.2.02.0.1.12.0.1.0 @@ -10,0 +11,61 @@ These release notes provide details of enhancements, features, known issues, and +## 2.1.0.0 + +Released 2026-03-20 + +The Amazon Athena The Amazon Athena ODBC v2.1.0.0 driver includes security improvements. This release enhances authentication flows, query processing, and transport security. We recommend upgrading to this version as soon as possible. + +### Breaking changes + + * SSL certificate validation enabled by default – The driver now enforces SSL certificate verification when connecting to identity providers. If you use a local identity provider without a valid SSL certificate, you must explicitly set `SSL_Insecure=1` in your connection string. For more information, see [SSL insecure (IdP)](./odbc-v2-driver-common-authentication-parameters.html#odbc-v2-driver-common-authentication-parameters-ssl-insecure-idp). + + * TLS 1.2 minimum enforced – The driver no longer accepts TLS 1.0 or TLS 1.1 connections to identity providers. All IdP connections now require TLS 1.2 or later. + + * BrowserSSOOIDC authentication flow updated – The BrowserSSOOIDC plugin now uses Authorization Code with PKCE instead of Device Code Authorization. A new optional parameter `listen_port` (default 7890) is available for the OAuth 2.0 callback server. You may need to allowlist this port on your network. The default scope has changed to `sso:account:access`. For more information, see [Browser SSO OIDC](./odbc-v2-driver-browser-sso-oidc.html). + + + + +### Improvements + + * BrowserSSOOIDC – Migrated from Device Code flow to Authorization Code with PKCE for improved security. + + * BrowserAzureAD – Added PKCE (Proof Key for Code Exchange) to the OAuth 2.0 authorization flow to prevent authorization code interception attacks. + + * BrowserSAML – Added RelayState CSRF protection to prevent SAML token injection attacks. + + * Credentials cache – Starting in v2.1.0.0, cached credentials are stored as plaintext JSON in the `user-profile/.athena-odbc/` directory with file permissions restricted to the owning user, consistent with how the AWS CLI protects locally stored credentials. + + * IAM Profile – Added support for `EcsContainer` and `Environment` credential sources in addition to the existing `Ec2InstanceMetadata`. + + * Connection string parser – Implemented proper ODBC `}}` escape handling. + + * Catalog queries – Added SQL identifier escaping for schema names and table patterns. + + * ODBC pattern matching – Replaced regex-based matching with direct ODBC LIKE wildcard matcher. + + * XML parsing – Added recursion depth limit (100 levels) and size limit (1MB) for SAML tokens. + + * ADFS authentication – Added response size limit (200KB) for ADFS server responses. + + + + +### Fixes + + * Fixed improper neutralization of special elements in authentication components that could allow code execution or authentication flow redirection via crafted connection parameters. Affects BrowserSSOOIDC, BrowserAzureAD, and BrowserSAML plugins. + + * Fixed improper neutralization of special elements in query processing components that could allow denial of service or SQL injection via crafted table metadata. + + * Fixed improper certificate validation when connecting to identity providers. + + * Fixed missing authentication security controls in browser-based authentication flows, including PKCE for OAuth, CSRF protection for SAML, secure credential caching, and exclusive callback port binding. + + * Fixed uncontrolled resource consumption in parsing components that could allow denial of service via crafted input patterns, unbounded server responses, or deeply nested XML payloads. + + * Fixed an issue where `SQLColumns` and `SQLTables` returned no results when using `UseSingleCatalogAndSchema=1` with cross-account federated catalogs in Power BI Import mode. + + + + +To download the new ODBC v2 driver, see [ODBC 2.x driver download](./odbc-v2-driver.html#odbc-v2-driver-download). For connection information, see [Amazon Athena ODBC 2.x](./odbc-v2-driver.html). +