Skip to content
Submit incident
AII-1002-63623
ConfirmedA court, a regulator or the organization itself has stated the core facts, or the record cites a court or regulator source.

Snowflake Connector for Python cache files world-readable on Linux

Snowflake Connector for Python versions 2.3.7 through 3.13.0 stored temporary authentication credentials in world-readable cache files on Linux systems. Snowflake published a security advisory and released version 3.13.1 to fix the vulnerability.

29 January 2025 · Snowflake · Security and cyberattacks
29 January 2025

Drafted by Raidu Incident Detection, an automated system.

AII-1002-63623View source ↗
Quick facts
Category
Security and cyberattacks
Source
github.com
Date
29 January 2025
Drafted by
Raidu Incident Detection

What happened

On Linux systems, Snowflake Connector for Python versions 2.3.7 through 3.13.0 cached temporary credentials in world-readable files when using EXTERNALBROWSER or USERNAME_PASSWORD_MFA authentication methods with temporary credential caching enabled.

Snowflake fixed the vulnerability in version 3.13.1 by restricting cache file permissions.

Reported impact

The world-readable permissions on cache files could allow unauthorized local users to access temporary credentials.

Index analysis

The vulnerability affects the confidentiality and integrity of cached credentials with a CVSS v3.1 base score of 4.4 (Moderate severity), requiring local access and low privilege to exploit.

Classification

Category
Security and cyberattacks
Harm status
Potential harm
Intent
Unintentional
Timing
Post-deployment
Harmed
Consumers
Failure modes
Data leak

Sources and evidence

This record was researched and written by the Index, based on the following original reporting.

github.com
https://github.com/snowflakedb/snowflake-connector-python/security/advisories/GHSA-r2x6-cjg7-8r43