Local Privilege Escalation in Snowflake Connector for Python
CVE-2025-24794

6.7MEDIUM

Key Information:

Vendor

Snowflakedb

Status
Snowflake-connector-python
Vendor
CVE Published:
29 January 2025

What is CVE-2025-24794?

The Snowflake Connector for Python has a vulnerability in its OCSP response cache that uses the pickle serialization format, which can allow malicious actors to manipulate serialized data. This can lead to local privilege escalation, posing a significant risk in Python applications that depend on this connector. Snowflake has addressed this issue in version 3.13.1, and it is recommended for all users to upgrade to mitigate this risk.

Affected Version(s)

snowflake-connector-python >= 2.7.12, < 3.13.1

References

https://github.com/snowflakedb/snowflake-connector-python...
x_refsource_CONFIRM
https://github.com/snowflakedb/snowflake-connector-python...
x_refsource_MISC

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.