CVEvulnerability

CVE-2025-46329

3.3 LOW Published 2025-04-29 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2025-04-29
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
3.3 LOW — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 3.1 ([email protected])
3.3 LOW — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-532

Description

libsnowflakeclient is the Snowflake Connector for C/C++. Versions starting from 0.5.0 to before 2.2.0, are vulnerable to local logging of sensitive information. When the logging level was set to DEBUG, the Connector would log locally the client-side encryption master key of the target stage during the execution of GET/PUT commands. This key by itself does not grant access to any sensitive data without additional access authorizations, and is not logged server-side by Snowflake. This issue has been patched in version 2.2.0.

Affected configurations

• snowflake connector for c\/c\+\+ (>= 0.5.0 < 2.2.0)

Related

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References