PT-2025-18133 · Snowflake · Libsnowflakeclient

CVE-2025-46329 · Publicado 2025-04-29 · Atualizado 2025-05-09

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Baixa

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions libsnowflakeclient versions 0.5.0 through 2.2.0

Description The issue concerns local logging of sensitive information. When the logging level was set to DEBUG, the Connector would log locally the client-side encryption master key of the target stage during the execution of GET/PUT commands. This key by itself does not grant access to any sensitive data without additional access authorizations, and is not logged server-side by Snowflake.

Recommendations For versions 0.5.0 through 2.2.0, update to version 2.2.0 to resolve the issue. As a temporary workaround, consider setting the logging level to a value other than DEBUG to prevent local logging of sensitive information.

Exploit

Correção

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

CVE-2025-46329

GHSA-JX4F-645P-WJPX

Produtos afetados

Libsnowflakeclient

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46329.json · Exploit
• https://github.com/snowflakedb/libsnowflakeclient/commit/3caa8a6a3ee95e0a66ead03b4bf6a2d1ca42ebfe · Correção
• https://github.com/snowflakedb/libsnowflakeclient/security/advisories/GHSA-jx4f-645p-wjpx · Aviso do Fabricante
• https://twitter.com/cybercronai/status/1917226247869833696 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1917118216549155091 · Publicação no Twitter
• https://t.me/cvenotify/121610 · Publicação no Telegram
• https://t.me/cvetracker/22597 · Publicação no Telegram
• https://t.me/cvedetector/23981 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-46329 · Nota de Segurança
• https://twitter.com/CVEnew/status/1917077486703149075 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-46329 · Aviso do Fabricante