CVE-2025-46329

libsnowflakeclient is the Snowflake Connector for C/C++. Versions starting from 0.5.0 to before 2.2.0, are vulnerable to local logging of sensitive information. When the logging level was set to DEBUG, the Connector would log locally the client-side encryption master key of the target stage during the execution of GET/PUT commands. This key by itself does not grant access to any sensitive data without additional access authorizations, and is not logged server-side by Snowflake. This issue has been patched in version 2.2.0.

CVSS v3 3.3 LOW

3.3^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/snowflakedb/libsnowflakeclient/commit/3caa8a6a3ee95e0a66ead03b4bf6a2d1ca42ebfe	Patch
https://github.com/snowflakedb/libsnowflakeclient/security/advisories/GHSA-jx4f-645p-wjpx	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:snowflake:connector_for_c\/c\+\+:*:*:*:*:*:*:*:*

History

09 May 2025, 19:37

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-04-29 05:15

Updated : 2025-05-09 19:37

NVD link : CVE-2025-46329

Mitre link : CVE-2025-46329

CVE.ORG link : CVE-2025-46329

JSON object : View

Products Affected

snowflake

connector_for_c\/c\+\+

CWE

CWE-532

Insertion of Sensitive Information into Log File

{"id": "CVE-2025-46329", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.8}]}, "published": "2025-04-29T05:15:46.650", "references": [{"url": "https://github.com/snowflakedb/libsnowflakeclient/commit/3caa8a6a3ee95e0a66ead03b4bf6a2d1ca42ebfe", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/snowflakedb/libsnowflakeclient/security/advisories/GHSA-jx4f-645p-wjpx", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "libsnowflakeclient is the Snowflake Connector for C/C++. Versions starting from 0.5.0 to before 2.2.0, are vulnerable to local logging of sensitive information. When the logging level was set to DEBUG, the Connector would log locally the client-side encryption master key of the target stage during the execution of GET/PUT commands. This key by itself does not grant access to any sensitive data without additional access authorizations, and is not logged server-side by Snowflake. This issue has been patched in version 2.2.0."}, {"lang": "es", "value": "libsnowflakeclient es el conector de Snowflake para C/C++. Las versiones desde la 0.5.0 hasta la 2.2.0 anteriores son vulnerables al registro local de informaci\u00f3n confidencial. Cuando el nivel de registro se establec\u00eda en DEBUG, el conector registraba localmente la clave maestra de cifrado del lado del cliente de la etapa de destino durante la ejecuci\u00f3n de comandos GET/PUT. Esta clave, por s\u00ed sola, no otorga acceso a datos confidenciales sin autorizaciones de acceso adicionales y Snowflake no la registra en el servidor. Este problema se ha corregido en la versi\u00f3n 2.2.0."}], "lastModified": "2025-05-09T19:37:56.527", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:snowflake:connector_for_c\\/c\\+\\+:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F0A1F10B-37C7-47D5-AB9E-A657E899CED4", "versionEndExcluding": "2.2.0", "versionStartIncluding": "0.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}