CVE-2025-27496lowCWE-532

CVE-2025-27496: falha de baixa gravidade em snowflakedb snowflake-jdbc

Snowflake JDBC Driver client-side encryption key in DEBUG logs

Publicada em

Seguir esta CVE+ Monitorar snowflake-jdbc+ Monitorar net.snowflake:snowflake-jdbc

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 3.3epss 0.1%
Snowflake, a platform for using artificial intelligence in the context of cloud computing, has a vulnerability in the Snowflake JDBC driver ("Driver") in versions 3.0.13 through 3.23.0 of the driver. When the logging level was set to DEBUG, the Driver would log locally the client-side encryption master key of the target stage during the execution of GET/PUT commands. This key by itself does not grant access to any sensitive data without additional access authorizations, and is not logged server-side by Snowflake. Snowflake fixed the issue in version 3.23.1.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
snowflakedb · snowflake-jdbc
CVEs relacionadas — snowflakedb snowflake-jdbc

No mesmo produto, das mais perigosas para as menos.

CVE-2023-30535HIGHSnowflake JDBC vulnerable to command injection via SSO URL authenticationEPSS 1.7%CVE-2026-3293MEDIUMsnowflakedb snowflake-jdbc JDBC URL SdkProxyRoutePlanner.java SdkProxyRoutePlanner redosEPSS 0.3%CVE-2025-24789HIGHSnowflake JDBC allows an untrusted search path on WindowsEPSS 0.3%CVE-2025-24790MEDIUMSnowflake JDBC uses insecure temporary credential cache file permissionsEPSS 0.2%