CVE-2025-24794

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. The OCSP response cache uses pickle as the serialization format, potentially leading to local privilege escalation. This vulnerability affects versions 2.7.12 through 3.13.0. Snowflake fixed the issue in version 3.13.1.

CVSS v3 6.7 MEDIUM

6.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/snowflakedb/snowflake-connector-python/commit/3769b43822357c3874c40f5e74068458c2dc79af	Patch
https://github.com/snowflakedb/snowflake-connector-python/security/advisories/GHSA-m4f6-vcj4-w5mx	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:snowflake:snowflake_connector:*:*:*:*:*:python:*:*

History

No history.

Information

Published : 2025-01-29 21:15

Updated : 2025-08-25 18:09

NVD link : CVE-2025-24794

Mitre link : CVE-2025-24794

CVE.ORG link : CVE-2025-24794

JSON object : View

Products Affected

snowflake

snowflake_connector

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2025-24794", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.8}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2025-01-29T21:15:21.397", "references": [{"url": "https://github.com/snowflakedb/snowflake-connector-python/commit/3769b43822357c3874c40f5e74068458c2dc79af", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/snowflakedb/snowflake-connector-python/security/advisories/GHSA-m4f6-vcj4-w5mx", "tags": ["Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. The OCSP response cache uses pickle as the serialization format, potentially leading to local privilege escalation. This vulnerability affects versions 2.7.12 through 3.13.0. Snowflake fixed the issue in version 3.13.1."}, {"lang": "es", "value": "Snowflake Connector para Python proporciona una interfaz para desarrollar aplicaciones Python que se pueden conectar a Snowflake y realizar todas las operaciones est\u00e1ndar. Snowflake descubri\u00f3 y solucion\u00f3 una vulnerabilidad en el conector Snowflake para Python. La cach\u00e9 de respuesta de OCSP utiliza pickle como formato de serializaci\u00f3n, lo que puede provocar una escalada de privilegios locales. Esta vulnerabilidad afecta a las versiones 2.7.12 a 3.13.0. Snowflake solucion\u00f3 el problema en la versi\u00f3n 3.13.1."}], "lastModified": "2025-08-25T18:09:53.457", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:snowflake:snowflake_connector:*:*:*:*:*:python:*:*", "vulnerable": true, "matchCriteriaId": "A59175C4-68F8-4C6C-8B9D-A9841FC9E066", "versionEndExcluding": "3.13.1", "versionStartIncluding": "2.7.12"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}