PT-2025-11222 · Snowflake · Snowflake Jdbc Driver

Published 2025-03-13 · Updated 2025-03-13 · CVE-2025-27496

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Snowflake JDBC driver versions 3.0.13 through 3.23.0

Description: The issue concerns the Snowflake JDBC driver, where the client-side encryption master key of the target stage is logged locally when the logging level is set to DEBUG during GET/PUT commands. This key alone does not grant access to sensitive data without additional access authorizations and is not logged server-side by Snowflake.

Recommendations: For versions 3.0.13 through 3.23.0, update to version 3.23.1 to resolve the issue. As a temporary workaround, consider setting the logging level to a value other than DEBUG to prevent local logging of the client-side encryption master key.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2025-27496

GHSA-Q298-375F-5Q63

Affected Products

Snowflake Jdbc Driver

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27496.json · Exploit
• https://github.com/snowflakedb/snowflake-jdbc/commit/ef81582ce2f1dbc3c8794a696c94f4fe65fad507 · Patch
• https://github.com/snowflakedb/snowflake-jdbc/security/advisories/GHSA-q298-375f-5q63 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q298-375f-5q63 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27496 · Security Note
• https://osv.dev/vulnerability/CVE-2025-27496 · Vendor Advisory
• https://github.com/snowflakedb/snowflake-jdbc · Note
• https://t.me/cvetracker/19082 · Telegram Post
• https://t.me/cvedetector/20250 · Telegram Post
• https://twitter.com/CVEnew/status/1900266852384723454 · Twitter Post