CVE-2024-49750: Snowflake connector python The Snowflake Connector For Python Vulnerability
MODERATECVE-2024-49750 is a MODERATE (CVSS 5.5) the snowflake connector for python vulnerability (CWE-532: Insertion of Sensitive Information into Log File) affecting Snowflake connector python libraries in the PyPI ecosystem. The issue involves the snowflake connector for python stores sensitive data in logs. Remediation is available by upgrading affected packages to version 3.12.3.
CVE-2024-49750 at a Glance
Security Impact
CVSS: 5.5
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
How to Fix CVE-2024-49750
To remediate this vulnerability, upgrade all affected Snowflake connector python dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
pip install snowflake-connector-python>=3.12.3Run the following command in your project directory to verify that all resolved dependencies use the patched release:
pip show snowflake-connector-pythonHow to Check if You Are Affected
To determine whether your Python environment is affected by CVE-2024-49750, inspect your installed packages using pip:
pip show snowflake-connector-pythonAnalyze the terminal output to locate any version of Snowflake connector python in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 3.12.3), your application is affected.
Note: The pip show snowflake-connector-python command checks currently installed packages in your active Python environment.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-532: Insertion of Sensitive Information into Log File, where the product writes sensitive information to a log file. In Snowflake connector python, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2024-49750 Affected Snowflake connector python Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
snowflake-connector-python
|
PyPI |
< 3.12.3
|
3.12.3
|
References
Frequently Asked Questions
What is CVE-2024-49750?
Which Snowflake connector python versions are affected?
What version fixes CVE-2024-49750?
Is snowflake-connector-python affected?
What is the CVSS score of CVE-2024-49750?
What CWE is associated with CVE-2024-49750?
How can I check PyPI dependencies for CVE-2024-49750?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-5vvg-pvhp-hv2m",
"modified" : "2025-01-21T17:58:50Z",
"published" : "2024-10-24T22:42:26Z",
"aliases" : [ "CVE-2024-49750" ],
"summary" : "The Snowflake Connector for Python stores sensitive data in logs",
"details" : "### Issue\nSnowflake recently learned about and remediated a set of vulnerabilities in the Snowflake Connector for Python. Under specific conditions, certain users credentials (or portions of those credentials) were logged locally by the Connector to the users own systems. The credentials were not logged by Snowflake.\n\nThese vulnerabilities affect versions up to and including 3.12.2. Snowflake fixed the issue in version 3.12.3.\n\n### Vulnerability Details\nWhen the logging level was set by the user to DEBUG, the Connector could have logged Duo passcodes (when specified via the “passcode” parameter) and Azure SAS tokens. Additionally, the [SecretDetector](https://docs.snowflake.com/en/developer-guide/python-connector/python-connector-example#logging) logging formatter, if enabled, contained bugs which caused it to not fully redact JWT tokens and certain private key formats.\n\n### Solution\nSnowflake released version 3.12.3 of the Snowflake Connector for Python, which fixes these issues. We recommend users upgrade to version 3.12.3 and review their logs for any potentially sensitive information that may have been captured.\n\n### Additional Information\nIf you discover a security vulnerability in one of our products or websites, please report the issue to HackerOne. For more information, please see our [Vulnerability Disclosure Policy](https://hackerone.com/snowflake?type=team).",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "PyPI",
"name" : "snowflake-connector-python"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "3.12.3"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/snowflakedb/snowflake-connector-python/security/advisories/GHSA-5vvg-pvhp-hv2m"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-49750"
}, {
"type" : "WEB",
"url" : "https://github.com/snowflakedb/snowflake-connector-python/commit/dbc9284a3c0382c131b971b35e8d6ab93c46f37a"
}, {
"type" : "WEB",
"url" : "https://github.com/pypa/advisory-database/tree/main/vulns/snowflake-connector-python/PYSEC-2024-191.yaml"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/snowflakedb/snowflake-connector-python"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-532" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2024-10-24T22:42:26Z",
"nvd_published_at" : "2024-10-24T22:15:04Z"
}
}