PT-2025-18087 · Snowflake · Snowflake Jdbc Driver

Published 2025-04-28 · Updated 2025-04-29 · CVE-2025-46614

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Snowflake ODBC Driver versions prior to 3.7.0

Description The issue concerns the logging of sensitive information. In certain code paths, the whole SQL query was logged at the INFO level. This could potentially lead to the exposure of sensitive data.

Recommendations For Snowflake ODBC Driver versions prior to 3.7.0, update to version 3.7.0 or later to resolve the issue. As a temporary workaround, consider configuring the logging settings to exclude sensitive information, such as SQL queries, from being logged at the INFO level. Restrict access to log files to minimize the risk of sensitive data exposure.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2025-46614

Affected Products

Snowflake Jdbc Driver

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-46614 · Security Note
• https://twitter.com/CVEnew/status/1916878943791022401 · Twitter Post
• https://t.me/cvedetector/23919 · Telegram Post
• https://t.me/cvetracker/22544 · Telegram Post
• https://community.snowflake.com/s/article/Snowflake-Connector-for-ODBC-Security-Advisory-CVE-2025-46614 · Note
• https://twitter.com/cybercronai/status/1917226247869833696 · Twitter Post