Signed-to-Unsigned Conversion Flaw in Snowflake PHP Driver Affecting Database Connections
CVE-2025-24792

4.4MEDIUM

Key Information:

Vendor

Snowflakedb

Status
Pdo Snowflake
Vendor
CVE Published:
29 January 2025

What is CVE-2025-24792?

A vulnerability in the Snowflake PHP PDO Driver allows for execution of unsupported queries, such as PUT or GET commands on stages. This leads to a conversion error between signed and unsigned values, resulting in a crash of any application utilizing the driver. Affected versions range from 0.2.0 through 3.0.3, with necessary patches included in version 3.1.0.

Affected Version(s)

pdo_snowflake >= 0.2.0, < 3.1.0

References

https://github.com/snowflakedb/pdo_snowflake/security/adv...
x_refsource_CONFIRM

CVSS V3.1

Score:
4.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.