PT-2025-5576 · Snowflake · Snowflake Connector For Python

Published 2025-01-29 · Updated 2025-01-29 · CVE-2025-24795

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Snowflake Connector for Python versions 2.3.7 through 3.13.0

Description The Snowflake Connector for Python stores temporary credentials locally in a world-readable file when temporary credential caching is enabled on Linux systems. This issue affects versions 2.3.7 through 3.13.0. The problem was fixed in version 3.13.1.

Recommendations For versions 2.3.7 through 3.13.0, upgrade to version 3.13.1 to resolve the issue. As a temporary workaround, consider disabling temporary credential caching until the patch is applied. Restrict access to the local file where temporary credentials are cached to minimize the risk of exploitation.

Exploit

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2025-24795

GHSA-R2X6-CJG7-8R43

PYSEC-2025-28

Affected Products

Snowflake Connector For Python

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24795.json · Exploit
• https://osv.dev/vulnerability/PYSEC-2025-28 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-24795 · Security Note
• https://osv.dev/vulnerability/GHSA-r2x6-cjg7-8r43 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-24795 · Vendor Advisory
• https://github.com/snowflakedb/snowflake-connector-python/commit/3769b43822357c3874c40f5e74068458c2dc79af · Note
• https://github.com/snowflakedb/snowflake-connector-python/security/advisories/GHSA-r2x6-cjg7-8r43 · Note
• https://github.com/snowflakedb/snowflake-connector-python · Note
• https://github.com/snowflakedb/snowflake-connector-python/releases/tag/v3.13.1 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/snowflake-connector-python/PYSEC-2025-28.yaml · Note
• https://twitter.com/CVEnew/status/1884703060444012793 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1884722974718062642 · Twitter Post
• https://t.me/cvedetector/16704 · Telegram Post