Snowflake Connector .NET does not properly check the Certificate Revocation List (CRL)
CVE-2023-51662

6MEDIUM

Key Information:

Vendor

snowflakedb

Status
snowflake-connector-net
Vendor
CVE Published:
22 December 2023

What is CVE-2023-51662?

The Snowflake .NET driver provides an interface to the Microsoft .NET open source software framework for developing applications. Snowflake recently received a report about a vulnerability in the Snowflake Connector .NET where the checks against the Certificate Revocation List (CRL) were not performed where the insecureMode flag was set to false, which is the default setting. The vulnerability affects versions between 2.0.25 and 2.1.4 (inclusive). Snowflake fixed the issue in version 2.1.5.

Affected Version(s)

snowflake-connector-net >= 2.0.25, <= 2.1.4

References

https://github.com/snowflakedb/snowflake-connector-net/se...
x_refsource_CONFIRM
https://docs.snowflake.com/release-notes/clients-drivers/...
x_refsource_MISC

CVSS V3.1

Score:
6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.