{"uuid": "70c38be1-3ee4-4c6d-ac4c-4dde0baed2c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "GHSA-R2X6-CJG7-8R43", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/3399", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: GHSA-r2x6-cjg7-8r43\n\ud83d\udd25 CVSS Score: 4.3 (CVSS_V3)\n\ud83d\udd39 Description: ### Issue\nSnowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. On Linux systems, when temporary credential caching is enabled, the Snowflake Connector for Python will cache temporary credentials locally in a world-readable file.\n\nThis vulnerability affects versions 2.3.7 through 3.13.0. Snowflake fixed the issue in version 3.13.1.\n\n### Vulnerability Details\nOn Linux, when either EXTERNALBROWSER or USERNAME_PASSWORD_MFA authentication methods are used with temporary credential caching enabled, the Snowflake Connector for Python will cache the temporary credentials in a local file. In the vulnerable versions of the Driver, this file is created with world-readable permissions.\n\n### Solution\nSnowflake released version 3.13.1 of the Snowflake Connector for Python, which fixes this issue. We recommend users upgrade to version 3.13.1.\n\n### Additional Information\nIf you discover a security vulnerability in one of our products or websites, please report the issue to HackerOne. For more information, please see our [Vulnerability Disclosure Policy](https://hackerone.com/snowflake?type=team).\n\ud83d\udccf Published: 2025-01-29T20:49:59Z\n\ud83d\udccf Modified: 2025-01-29T20:49:59Z\n\ud83d\udd17 References:\n1. https://github.com/snowflakedb/snowflake-connector-python/security/advisories/GHSA-r2x6-cjg7-8r43\n2. https://github.com/snowflakedb/snowflake-connector-python\n3. https://github.com/snowflakedb/snowflake-connector-python/releases/tag/v3.13.1", "creation_timestamp": "2025-01-29T21:11:09.000000Z"}