VDB

CVE-2025-24795

CVE-2025-24795 PUBLISHED CVSS 4.400000095367432 MEDIUM

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. On Linux systems, when temporary credential caching is enabled, the Snowflake Connector for Python will cache temporary credentials locally in a world-readable file. This vulnerability affects versions 2.3.7 through 3.13.0. Snowflake fixed the issue in version 3.13.1.

EPSS 0.14% · 34.0th percentile

Risk Scores

CVSS v3.1
4.400000095367432
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS Score
0.14%
34.0th percentile

Affected Products

VendorProductVersions
snowflakesnowflake_connector2.3.7
snowflakedbsnowflake-connector-python>= 2.3.7, < 3.13.1
PyPIsnowflake-connector-python2.3.7

Timeline

  • Jan 21, 1970 Security Advisory
  • Jan 29, 2025 CVE Published
  • Jan 29, 2025 PoC Published
  • Jan 29, 2025 PoC Published
  • Jan 30, 2025 EPSS Score
  • Feb 14, 2025 EPSS Score
  • Feb 22, 2025 Coalition ESS Score
  • Mar 1, 2025 EPSS Score
  • Mar 16, 2025 EPSS Score
  • Mar 31, 2025 EPSS Score
  • Apr 15, 2025 EPSS Score
  • Apr 30, 2025 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›