PT-2025-18133 · Snowflake · Libsnowflakeclient

Published 2025-04-29 · Updated 2025-05-09 · CVE-2025-46329

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions libsnowflakeclient versions 0.5.0 through 2.2.0

Description The issue concerns local logging of sensitive information. When the logging level was set to DEBUG, the Connector would log locally the client-side encryption master key of the target stage during the execution of GET/PUT commands. This key by itself does not grant access to any sensitive data without additional access authorizations, and is not logged server-side by Snowflake.

Recommendations For versions 0.5.0 through 2.2.0, update to version 2.2.0 to resolve the issue. As a temporary workaround, consider setting the logging level to a value other than DEBUG to prevent local logging of sensitive information.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2025-46329

GHSA-JX4F-645P-WJPX

Affected Products

Libsnowflakeclient

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46329.json · Exploit
• https://github.com/snowflakedb/libsnowflakeclient/commit/3caa8a6a3ee95e0a66ead03b4bf6a2d1ca42ebfe · Patch
• https://github.com/snowflakedb/libsnowflakeclient/security/advisories/GHSA-jx4f-645p-wjpx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46329 · Security Note
• https://osv.dev/vulnerability/CVE-2025-46329 · Vendor Advisory
• https://twitter.com/cybercronai/status/1917226247869833696 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1917118216549155091 · Twitter Post
• https://t.me/cvenotify/121610 · Telegram Post
• https://t.me/cvetracker/22597 · Telegram Post
• https://t.me/cvedetector/23981 · Telegram Post
• https://twitter.com/CVEnew/status/1917077486703149075 · Twitter Post