Snowflake Connector for Python SQL注入漏洞

Snowflake Connector for Python is an open source interface from Snowflake Computing. It is used to develop Python applications that can connect to Snowflake and perform all standard operations. A SQL injection vulnerability exists in Snowflake Connector for Python versions prior to 3.13.1, which...

Snowflake snowflake-connector-net 安全漏洞

Snowflake snowflake-connector-net is the Snowflake connector from Snowflake USA for . A security vulnerability exists in snowflake-connector-net versions prior to 4.3.0, which originates when files downloaded from the Stage are temporarily placed in a globally-readable local directory, allowing...

PT-2025-5569 · Snowflake · Snowflake-Connector-Net

Name of the Vulnerable Software and Affected Versions: snowflake-connector-net versions 2.0.12 through 4.2.0 Description: The issue arises when files downloaded from stages are temporarily placed in a world-readable local directory, making them accessible to unauthorized users on the same machine...

Sensitive Information Disclosure

snowflakeconnectorpython is vulnerable to Sensitive Information Disclosure. The vulnerability is due to the Connector logging Duo passcodes and Azure SAS tokens when the logging level is set to DEBUG, and bugs in the SecretDetector logging formatter that failed to fully redact JWT tokens and...

acedeploy (>=2.4.15 <=2.4.115), apache-airflow-providers-snowflake (>=2.4.0 <=2.5.1rc1) +121 more potentially affected by CVE-2024-49750 via snowflake-connector-python (>=1.7.11 <=3.12.2)

snowflake-connector-python PYPI version =1.7.11, =2.4.15, =2.4.0, =0.0.4, =0.1.0, =1.13.21, =20230717.1.0, =0.4.0, =0.1.0, =0.4.0, =0.5.1, =1.0.5, =1.0.6 and more Source cves: CVE-2024-49750 Source advisory: OSV:GHSA-5VVG-PVHP-HV2M...

GHSA-5VVG-PVHP-HV2M The Snowflake Connector for Python stores sensitive data in logs

Issue Snowflake recently learned about and remediated a set of vulnerabilities in the Snowflake Connector for Python. Under specific conditions, certain users credentials or portions of those credentials were logged locally by the Connector to the users own systems. The credentials were not logge...

Insertion of Sensitive Information into Log File

Overview snowflake-connector-python is a Snowflake Connector for Python Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File due to the logging of sensitive information when the logging level is set to DEBUG. An attacker can access sensitive data su...

acedeploy (>=2.4.15 <=2.4.115), authz-analyzer (=0.1.1) +27 more potentially affected by CVE-2024-49750 via snowflake-connector-python (>=3.0.0 <=3.12.2)

snowflake-connector-python PYPI version =3.0.0, =2.4.15, =0.1.0, =0.4.0, =0.2.1, =0.0.12, =4.5.0, =0.2.0, =0.0.14, =0.0.83, =0.2.13a0 - nuvolos =0.5.1 - oc-pipelinewise-target-snowflake =2.2.0 and more Source cves: CVE-2024-49750 Source advisory: SNYK:PYTHON-SNOWFLAKECONNECTORPYTHON-8303773...

CVE-2024-49750

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Prior to version 3.12.3, when the logging level was set by the user to DEBUG, the Connector could have logged Duo passcodes when specified...

PYSEC-2024-191

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Prior to version 3.12.3, when the logging level was set by the user to DEBUG, the Connector could have logged Duo passcodes when specified...

acedeploy (>=2.4.15 <=2.4.115), apache-airflow-providers-snowflake (>=2.4.0 <=2.5.1rc1) +121 more potentially affected by CVE-2024-49750 via snowflake-connector-python (>=1.7.11 <=3.12.2)

snowflake-connector-python PYPI version =1.7.11, =2.4.15, =2.4.0, =0.0.4, =0.1.0, =1.13.21, =20230717.1.0, =0.4.0, =0.1.0, =0.4.0, =0.5.1, =1.0.5, =1.0.6 and more Source cves: CVE-2024-49750 Source advisory: OSV:PYSEC-2024-191...

PYSEC-2024-191

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Prior to version 3.12.3, when the logging level was set by the user to DEBUG, the Connector could have logged Duo passcodes when specified...

CVE-2024-49750

Summary (CVE-2024-49750): The Snowflake Connector for Python is affected by exposure of sensitive data in logs prior to version 3.12.3. Under DEBUG logging, credentials such as Duo passcodes and Azure SAS tokens could be logged, and the SecretDetector formatter could fail to fully redact JWTs and...

The vulnerability of the Snowflake Connector .NET driver for working with the cloud-based data processing and storage platform Snowflake on the .NET platform lies in errors related to the certificate validation process. This allows attackers to carry out “man-in-the-middle” attacks.

The vulnerability of the Snowflake Connector .NET driver for working with the cloud-based data processing and storage platform Snowflake on the .NET platform is related to errors in the certificate validation process. Exploiting this vulnerability could allow an attacker to carry out a...

snowflake-connector-net Trust Management Issues Vulnerability

Snowflake snowflake-connector-net is a Snowflake connector for . A trust management issue vulnerability exists in snowflake-connector-net versions 2.0.25 through 2.1.4 due to a failure to perform a check against the Certificate Revocation List CRL...

apache-airflow-providers-snowflake (>=2.4.0 <=2.5.1rc1), arreyy (=0.0.1) +96 more potentially affected by CVE-2023-34233 via snowflake-connector-python (>=1.7.11 <=3.0.0)

snowflake-connector-python PYPI version =1.7.11, =2.4.0, =0.0.4, =0.1.0, =1.13.21, =20230717.1.0, =0.1.0, =0.4.0, =0.5.1, =1.0.5, =0.5.19, =0.1.1, =0.6.8, =0.8.9 and more Source cves: CVE-2023-34233 Source advisory: OSV:GHSA-5W5M-PFW9-C8FP...

CVE-2023-34230

snowflake-connector-net, the Snowflake Connector for .NET, is vulnerable to command injection prior to version 2.0.18 via SSO URL authentication. In order to exploit the potential for command injection, an attacker would need to be successful in 1 establishing a malicious resource and 2 redirecti...

CVE-2023-34233

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Versions prior to 3.0.2 are vulnerable to command injection via single sign-onSSO browser URL authentication. In order to exploit the...

apache-airflow-providers-snowflake (>=2.4.0 <=2.5.1rc1), arreyy (=0.0.1) +96 more potentially affected by CVE-2023-34233 via snowflake-connector-python (>=1.7.11 <=3.0.0)

snowflake-connector-python PYPI version =1.7.11, =2.4.0, =0.0.4, =0.1.0, =1.13.21, =20230717.1.0, =0.1.0, =0.4.0, =0.5.1, =1.0.5, =0.5.19, =0.1.1, =0.6.8, =0.8.9 and more Source cves: CVE-2023-34233 Source advisory: OSV:PYSEC-2023-88...

Command injection

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Versions prior to 3.0.2 are vulnerable to command injection via single sign-onSSO browser URL authentication. In order to exploit the...