Snowflake.Data has weak temporary files permissions
Issue
Snowflake discovered and remediated a vulnerability in the Snowflake Connector for .NET in which files downloaded from stages are temporarily placed in a world-readable local directory, making them accessible to unauthorized users on the same machine.
This vulnerability affects versions 2.0.12 through 4.2.0 on Linux and macOS. Snowflake fixed the issue in version 4.3.0.
Vulnerability Details
When downloading files from stages, the Snowflake Connector for .NET uses the OS temporary directory to save files before copying them to the destination directory. The files in the temporary directory, which are removed once the write to the destination directory concludes, have world-readable permissions on Linux and macOS. This could allow any user on the local machine to access them during their limited lifetime.
Solution
Snowflake released version 4.3.0 of the Snowflake Connector for .NET, which fixes this issue. We recommend users upgrade to version 4.3.0.
Additional Information
If you discover a security vulnerability in one of our products or websites, please report the issue to HackerOne. For more information, please see our Vulnerability Disclosure Policy.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| .NET (NuGet) | Snowflake.Data | >= 2.0.12, < 4.3.0 | 4.3.0 |
Referencias
- https://github.com/snowflakedb/snowflake-connector-net/security/advisories/GHSA-2mqw-rq5m-8hc8
- https://nvd.nist.gov/vuln/detail/CVE-2025-24788
- https://github.com/snowflakedb/snowflake-connector-net/commit/89d91e8316ca213c5d184bcf469ed93977a5edf9
- https://github.com/snowflakedb/snowflake-connector-net
- Vector CVSS
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N- Debilidad (CWE)
CWE-276- Plataforma
- .NET (NuGet)
- Paquete
Snowflake.Data- Publicada
- 29.01.2025
- Actualizado
- 11.10.2026 11:23
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-2mqw-rq5m-8hc8 - CC BY 4.0
Historial de vulnerabilidades: Snowflake.Data
Todas las vulnerabilidades publicadas de este paquete (.NET (NuGet)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 4
- Primera → última
- 06.2023 04.2025
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 1
- Media 2
- Baja 1
Divulgaciones por año
- 2023: 2
- 2024: 0
- 2025: 2
- 2026: 0
-
Snowflake.Data has weak temporary files permissions esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.