GHSA-M4F6-VCJ4-W5MX snowflake-connector-python vulnerable to insecure deserialization of the OCSP response cache

Issue Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. The OCSP response cache uses pickle as the serialization format, potentially leading to local privilege escalation. This vulnerability affects versions 2.7.12 through 3.13.0. Snowflake fixed the issue...

acedeploy (>=2.4.15, <=2.4.115), acepolicies (>=0.1.17, <=0.1.23) +104 more potentially affected by CVE-2025-24794 via snowflake-connector-python (>=2.7.12, <=3.13.0)

snowflake-connector-python PYPI version =2.7.12, =2.4.15, =0.1.17, =0.0.1.dev7, =0.1.0.dev1, =0.0.1a4.post0, =1.0.23, =0.1.3, =0.1.0, =1.13.21, =20241210.4.0, =20230717.1.0, =20240129.2.0 - clope 0.1.2 and more Source cves: CVE-2025-24794 Source advisory: GHSA-M4F6-VCJ4-W5MX...

acedeploy (>=2.4.15, <=2.4.115), acepolicies (>=0.1.17, <=0.1.23) +104 more potentially affected by CVE-2025-24794 via snowflake-connector-python (>=2.7.12, <=3.13.0)

snowflake-connector-python PYPI version =2.7.12, =2.4.15, =0.1.17, =0.0.1.dev7, =0.1.0.dev1, =0.0.1a4.post0, =1.0.23, =0.1.3, =0.1.0, =1.13.21, =20241210.4.0, =20230717.1.0, =20240129.2.0 - clope 0.1.2 and more Source cves: CVE-2025-24794 Source advisory: SNYK:PYTHON-SNOWFLAKECONNECTORPYTHON-8674...

GHSA-R2X6-CJG7-8R43 snowflake-connector-python vulnerable to insecure cache files permissions

Issue Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. On Linux systems, when temporary credential caching is enabled, the Snowflake Connector for Python will cache temporary credentials locally in a world-readable file. This vulnerability affects version...

CVE-2025-24794 The Snowflake Connector for Python uses insecure deserialization of the OCSP response cache

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. The OCSP response cache uses pickle as the...

acedeploy (>=2.4.15, <=2.4.115), acepolicies (>=0.1.17, <=0.1.23) +136 more potentially affected by CVE-2025-24793 via snowflake-connector-python (>=2.2.5, <=3.13.0)

snowflake-connector-python PYPI version =2.2.5, =2.4.15, =0.1.17, =0.0.1.dev7, =0.1.0.dev1, =0.0.1a4.post0, =2.4.0rc1, =1.0.23, =0.1.3, =0.1.0, =1.13.21, =20241210.4.0, =20250324.2.0 and more Source cves: CVE-2025-24793 Source advisory: MEND:CVE-2025-24793...

monosi (>=0.0.1.post1, <=0.0.2.post5), monosi-server (0.0.1) +1 more potentially affected by CVE-2024-49750 via snowflake-connector-python (2.7.2)

snowflake-connector-python PYPI version 2.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - monosi =0.0.1.post1, =0.0.2.post5 - monosi-server 0.0.1 - snowshu 0.0.4a1 Source cves: CVE-2024-49750 Source...

reclist (0.2.0) potentially affected by CVE-2024-49750 via snowflake-connector-python (2.1.2)

snowflake-connector-python PYPI version 2.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - reclist 0.2.0 Source cves: CVE-2024-49750 Source advisory: OSV:GHSA-5VVG-PVHP-HV2M...

pipelinewise-tap-snowflake (2.0.1), snowday (>=0.1.3, <=0.1.5) potentially affected by CVE-2024-49750 via snowflake-connector-python (2.2.9)

snowflake-connector-python PYPI version 2.2.9 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - pipelinewise-tap-snowflake 2.0.1 - snowday =0.1.3, =0.1.5 Source cves: CVE-2024-49750 Source advisory:...

dv-pyclient (>=0.5.1, <=0.6.0), snowctl (>=1.0.6, <=1.0.9) potentially affected by CVE-2024-49750 via snowflake-connector-python (2.2.4)

snowflake-connector-python PYPI version 2.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - dv-pyclient =0.5.1, =1.0.6, =1.0.9 Source cves: CVE-2024-49750 Source advisory: OSV:GHSA-5VVG-PVHP-HV2M...

bizzflow-toolkit (2.3.0.dev3), dbt (>=0.19.0rc1, <=0.19.2) +11 more potentially affected by CVE-2024-49750 via snowflake-connector-python (2.3.6)

snowflake-connector-python PYPI version 2.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - bizzflow-toolkit 2.3.0.dev3 - dbt =0.19.0rc1, =0.3.1, =1.9.1, =0.5.0, =0.1.0, =2.8.1, =1.0.11, =2.4.0,...

unskript-cloudnative-observability (>=0.1.4, <=1.0.1456) potentially affected by CVE-2024-49750 via snowflake-connector-python (2.7.6)

snowflake-connector-python PYPI version 2.7.6 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - unskript-cloudnative-observability =0.1.4, =1.0.1456 Source cves: CVE-2024-49750 Source advisory:...

target-snowflake (0.0.0) potentially affected by CVE-2024-49750 via snowflake-connector-python (1.8.7)

snowflake-connector-python PYPI version 1.8.7 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - target-snowflake 0.0.0 Source cves: CVE-2024-49750 Source advisory: OSV:GHSA-5VVG-PVHP-HV2M...

acedeploy (>=2.4.15, <=2.4.115), acepolicies (>=0.1.17, <=0.1.23) +52 more potentially affected by CVE-2024-49750 via snowflake-connector-python (>=3.0.0, <=3.12.2)

snowflake-connector-python PYPI version =3.0.0, =2.4.15, =0.1.17, =0.0.1.dev7, =0.1.0.dev1, =0.0.1a4.post0, =1.0.23, =0.1.0, =20241210.4.0, =20231128.1.0, =0.4.0, =0.21.8, =0.22.3 and more Source cves: CVE-2024-49750 Source advisory: GHSA-5VVG-PVHP-HV2M...

kpc-nifi-utils (0.2.3) potentially affected by CVE-2024-49750 via snowflake-connector-python (2.0.0)

snowflake-connector-python PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - kpc-nifi-utils 0.2.3 Source cves: CVE-2024-49750 Source advisory: OSV:GHSA-5VVG-PVHP-HV2M...

pipelinewise-target-snowflake (>=1.2.0, <=1.8.0), schemaql (>=0.0.2, <=0.0.4) potentially affected by CVE-2024-49750 via snowflake-connector-python (2.0.3)

snowflake-connector-python PYPI version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - pipelinewise-target-snowflake =1.2.0, =0.0.2, =0.0.4 Source cves: CVE-2024-49750 Source advisory:...

dagster-snowflake (>=0.4.0rc2, <=0.6.1) potentially affected by CVE-2024-49750 via snowflake-connector-python (1.7.11)

snowflake-connector-python PYPI version 1.7.11 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - dagster-snowflake =0.4.0rc2, =0.6.1 Source cves: CVE-2024-49750 Source advisory: OSV:GHSA-5VVG-PVHP-HV2M...

apache-airflow-providers-snowflake (>=2.4.0rc1, <=2.5.1), rcd-dev-kit (>=0.0.11, <=1.1.0) potentially affected by CVE-2024-49750 via snowflake-connector-python (2.7.1)

snowflake-connector-python PYPI version 2.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - apache-airflow-providers-snowflake =2.4.0rc1, =0.0.11, =1.1.0 Source cves: CVE-2024-49750 Source advisory:...

pipelinewise-tap-snowflake (2.0.3), pipelinewise-target-snowflake (1.10.1) +1 more potentially affected by CVE-2024-49750 via snowflake-connector-python (2.3.7)

snowflake-connector-python PYPI version 2.3.7 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - pipelinewise-tap-snowflake 2.0.3 - pipelinewise-target-snowflake 1.10.1 - snowmobile =0.2.0b16, =0.2.0b25...

pipelinewise-tap-snowflake (>=1.1.1, <=2.0.0) potentially affected by CVE-2024-49750 via snowflake-connector-python (2.2.2)

snowflake-connector-python PYPI version 2.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - pipelinewise-tap-snowflake =1.1.1, =2.0.0 Source cves: CVE-2024-49750 Source advisory: OSV:GHSA-5VVG-PVHP-HV...