TI-2025-18511 Aliases CVE-2025-24794 GHSA-m4f6-vcj4-w5mx

The Snowflake Connector for Python uses insecure deserialization of the OCSP response cache

LOW 34CWE-502Published 2025-01-29 · Updated 2025-01-31

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. The OCSP response cache uses pickle as the serialization format, potentially leading to local privilege escalation. This vulnerability affects versions 2.7.12 through 3.13.0. Snowflake fixed the issue in version 3.13.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0025 16th percentileScored 2026-11-07

Fix Fixed snowflake-connector-python (snowflakedb): 3.13.1snowflake-connector-python (PyPI): 3.13.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Snowflake	snowflake-connector-python	2.7.12 to before 3.13.1	3.13.1	Patch available	CNA
—	snowflake-connector-python (PyPI)	2.7.12 to before 3.13.1	3.13.1	Patch available	GHSA-m4f6-vcj4-w5mx

snowflake-connector-python VendorSnowflake Affected 2.7.12 to before 3.13.1 Fixed in 3.13.1 Patch available CNA
snowflake-connector-python (PyPI) Vendor— Affected 2.7.12 to before 3.13.1 Fixed in 3.13.1 Patch available GHSA-m4f6-vcj4-w5mx

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:snowflake:snowflake_connector::::::python::*	2.7.12 to before 3.13.1	Vulnerable	Snowflake

cpe:2.3:a:snowflake:snowflake_connector:*:*:*:*:*:python:*:* Versions 2.7.12 to before 3.13.1 Vulnerable ·Snowflake

Remediation

Fix · CNA snowflake-connector-python (snowflakedb) Fixed in 3.13.1
Fix · GHSA-m4f6-vcj4-w5mx snowflake-connector-python (PyPI) Fixed in 3.13.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-24794
2026-10-03 Alias added: GHSA-m4f6-vcj4-w5mx

References

Patch 1

https://github.com/snowflakedb/snowflake-connector-python/commit/3769b43822357c3874c40f5e74068458c2dc79af

Advisory 2

Other 3

TI-2022-20945 Exponential ReDoS in snowflake-connector-python leads to denial of service CVSS 3.1HIGH 7.5
TI-2023-17069 Snowflake Python Connector vulnerable to Command Injection CVSS 3.1HIGH 8.8
TI-2023-17068 Snowflake NodeJS Driver vulnerable to Command Injection CVSS 3.1HIGH 8.8
TI-2023-17066 Snowflake Connector vulnerable to Command Injection CVSS 3.1HIGH 8.8
TI-2025-18510 Snowflake Connector for Python has an SQL Injection in write_pandas CVSS 3.1HIGH 7.0
TI-2023-28309 Snowflake Connector .NET does not properly check the Certificate Revocation List (CRL) CVSS 3.1HIGH 7.5

See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences