p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de snowflake-connector-python

Vulnérabilité publiée pour snowflake-connector-python au cours des 30 derniers jours : 0. Dans le catalogue KEV : 0.

RSS ↗ JSON ↗
Filtrer les vulnérabilités
Effacer les filtres

Vulnérabilités : 8

  1. CVE-2026-86597

    Moyenne · CVSS 6.5EPSS 0,09%Correctif disponible

    Sensitive information written to logs by Snowflake drivers

    Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be written to diagnostic logs in circumstances where the available log redaction did not cover all affected log paths and data types. An attacker with read access to the log destination, whether the local filesystem, a log aggregation service, or a CI/CD artifact store, could obtain credentials and decryption keys that, if still valid at the time of access, could be used to authenticate to the corresponding Snow

    snowflake-connector-pythonPython
    • Mettez à jour vers 4.7.3
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  2. CVE-2026-15925

    Critique · CVSS 9.2EPSS 0,18%Correctif disponible

    Improper TLS Hostname Verification in Snowflake Connector for Python

    Improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7.1 and 3.18.1 may have allowed a network-positioned attacker to bypass certificate hostname validation on HTTPS connections made by the connector. An attacker with on-path network access could exploit this by intercepting or redirecting network traffic and presenting a certificate signed by any trusted CA for any domain, causing the connector to accept connections without validating that the certificate matched the requested hostname. Successful exploitation requires an on-path traffic interception capability (e.g. ARP/DNS poisoning, rogue access point,

    snowflake-connector-python snowflake-connector-python snowflake-connector-pythonPython
    • Mettez à jour vers 3.18.1
    • Mettez à jour vers 4.7.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  3. CVE-2025-24795

    Moyenne · CVSS 4.4EPSS 0,14%Correctif disponible

    The Snowflake Connector for Python uses insecure cache files permissions

    The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. On Linux systems, when temporary credential caching is enabled, the Snowflake Connector for Python will cache temporary credentials locally in a world-readable file. This vulnerability affects versions 2.3.7 through 3.13.0. Snowflake fixed the issue in version 3.13.1.

    snowflake-connector-python snowflake-connector-pythonPython
    • Mettez à jour vers 3.13.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  4. CVE-2025-24794

    Moyenne · CVSS 6.7EPSS 0,25%Correctif disponible

    The Snowflake Connector for Python uses insecure deserialization of the OCSP response cache

    The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. The OCSP response cache uses pickle as the serialization format, potentially leading to local privilege escalation. This vulnerability affects versions 2.7.12 through 3.13.0. Snowflake fixed the issue in version 3.13.1.

    snowflake-connector-python snowflake-connector-pythonPython
    • Mettez à jour vers 3.13.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  5. CVE-2025-24793

    Élevée · CVSS 7EPSS 0,31%Correctif disponible

    Snowflake Connector for Python has an SQL Injection in write_pandas

    The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. A function from the snowflake.connector.pandas_tools module is vulnerable to SQL injection. This vulnerability affects versions 2.2.5 through 3.13.0. Snowflake fixed the issue in version 3.13.1.

    snowflake-connector-python snowflake-connector-pythonPython
    • Mettez à jour vers 3.13.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  6. CVE-2024-49750

    Moyenne · CVSS 5.5EPSS 0,2%Correctif disponible

    Snowflake Connector for Python has sensitive data in logs

    The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Prior to version 3.12.3, when the logging level was set by the user to DEBUG, the Connector could have logged Duo passcodes (when specified via the `passcode` parameter) and Azure SAS tokens. Additionally, the SecretDetector logging formatter, if enabled, contained bugs which caused it to not fully redact JWT tokens and certain private key formats. Snowflake released version 3.12.3 of the Snowflake Connector for Python, which fixes the issue. In addition to upgrading, users should revie

    snowflake-connector-python snowflake-connector-pythonPython
    • Mettez à jour vers 3.12.3
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  7. CVE-2023-34233

    Élevée · CVSS 7.3EPSS 1,84%Correctif disponible

    Snowflake Python Connector vulnerable to Command Injection

    The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Versions prior to 3.0.2 are vulnerable to command injection via single sign-on(SSO) browser URL authentication. In order to exploit the potential for command injection, an attacker would need to be successful in (1) establishing a malicious resource and (2) redirecting users to utilize the resource. The attacker could set up a malicious, publicly accessible server which responds to the SSO URL with an attack payload. If the attacker then tricked a user into visiting the maliciously craf

    snowflake-connector-python snowflake-connector-pythonPython
    • Mettez à jour vers 3.0.2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  8. CVE-2022-42965

    Faible · CVSS 3.7EPSS 0,88%Correctif disponible

    Exponential ReDoS in snowflake-connector-python leads to denial of service

    An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the snowflake-connector-python PyPI package, when an attacker is able to supply arbitrary input to the undocumented get_file_transfer_type method

    snowflake-connector-pythonPython
    • Mettez à jour vers 2.8.2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →