Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2025-24794— The Snowflake Connector for Python uses insecure deserialization of the OCSP response cache

CVSS 6.7 · Medium EPSS 0.13% · P32
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2025-24794

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
The Snowflake Connector for Python uses insecure deserialization of the OCSP response cache
Source: NVD (National Vulnerability Database)
Vulnerability Description
The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. The OCSP response cache uses pickle as the serialization format, potentially leading to local privilege escalation. This vulnerability affects versions 2.7.12 through 3.13.0. Snowflake fixed the issue in version 3.13.1.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
可信数据的反序列化
Source: NVD (National Vulnerability Database)
Vulnerability Title
Snowflake Connector for Python 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Snowflake Connector for Python是Snowflake Computing开源的一个接口。用于开发可以连接到 Snowflake 并执行所有标准操作的 Python 应用程序。 Snowflake Connector for Python 3.13.1之前版本存在代码问题漏洞，该漏洞源于OCSP响应缓存使用pickle作为序列化格式，可能导致本地权限提升。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
snowflakedbsnowflake-connector-python >= 2.7.12, < 3.13.1 -

II. Public POCs for CVE-2025-24794

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-24794

请登录查看更多情报信息。

Same Patch Batch · snowflakedb · 2025-01-29 · 8 CVEs total

CVE-2025-247897.8 HIGHSnowflake JDBC allows an untrusted search path on Windows
CVE-2025-247937.0 HIGHSnowflake Connector for Python has an SQL Injection in write_pandas
CVE-2025-247885.0 MEDIUMSnowflake Connector for .NET has weak temporary files permissions
CVE-2025-247924.4 MEDIUMSnowflake PHP PDO Driver has a Signed-to-Unsigned Conversion Error
CVE-2025-247904.4 MEDIUMSnowflake JDBC uses insecure temporary credential cache file permissions
CVE-2025-247914.4 MEDIUMsnowflake-connector-nodejs has incorrect validation of temporary credential cache file per
CVE-2025-247954.4 MEDIUMThe Snowflake Connector for Python uses insecure cache files permissions

IV. Related Vulnerabilities

Same product: snowflake-connector-python
Same vendor: snowflakedb
Same weakness: CWE-502

V. Comments for CVE-2025-24794

No comments yet

Leave a comment