PT-2024-30544 · Snowflake · Snowflake Jdbc Driver

Published 2024-10-30 · Updated 2024-11-01 · CVE-2024-43382

Positive Technologies (AI Summary)

CVSS v4.0

6.5

Medium

Base vector

AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P

Name of the Vulnerable Software and Affected Versions Snowflake JDBC driver versions >= 3.2.6 and <= 3.19.1

Description The issue affects Snowflake JDBC drivers, resulting in data being uploaded to an encrypted stage without the additional layer of protection provided by client-side encryption. This occurs when the CLIENT ENCRYPTION KEY SIZE account parameter is set to 256-bit rather than the default 128-bit, affecting only a subset of accounts hosted on Azure and GCP deployments. The data is still protected by TLS in transit and server-side encryption at rest. The missed layer of additional protection is not visible to the affected customers.

Recommendations For Snowflake JDBC driver versions >= 3.2.6 and <= 3.19.1, upgrade to version 3.20.0 or later as soon as possible to fix the incorrect security setting. As a temporary workaround, consider avoiding the use of the CLIENT ENCRYPTION KEY SIZE parameter set to 256-bit until the issue is resolved. Restrict access to stages created with the vulnerable JDBC driver versions to minimize the risk of exploitation.

Fix

Missing Encryption of Sensitive Data

Inadequate Encryption Strength

Weakness Enumeration

CWE-311

CWE-326

Related Identifiers

CVE-2024-43382

GHSA-F686-HW9C-XW9C

Affected Products

Snowflake Jdbc Driver

References · 7

• https://github.com/snowflakedb/snowflake-jdbc/security/advisories/GHSA-f686-hw9c-xw9c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43382 · Security Note
• https://osv.dev/vulnerability/CVE-2024-43382 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f686-hw9c-xw9c · Vendor Advisory
• https://github.com/snowflakedb/snowflake-jdbc · Note
• https://t.me/cvedetector/9464 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1851809226718380117 · Twitter Post