6.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-24794

CVE-2025-24794: snowflake-connector-python vulnerable to insecure deserialization of the OCSP response cache

Issue

Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. The OCSP response cache uses pickle as the serialization format, potentially leading to local privilege escalation.

This vulnerability affects versions 2.7.12 through 3.13.0. Snowflake fixed the issue in version 3.13.1.

Vulnerability Details

The OCSP response cache is saved locally on the machine running the Connector using the pickle serialization format. This can potentially lead to local privilege escalation if an attacker has write access to the OCSP response cache file.

Solution

Snowflake released version 3.13.1 of the Snowflake Connector for Python, which fixes this issue. We recommend users upgrade to version 3.13.1.

Additional Information

If you discover a security vulnerability in one of our products or websites, please report the issue to HackerOne. For more information, please see our Vulnerability Disclosure Policy.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-24794

CVE-2025-24794:

6.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
snowflake-connector-python	pip	>= 2.7.12, <= 3.13.0	3.13.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability description states that the OCSP response cache used pickle for serialization, leading to potential local privilege escalation. The provided commit 3769b43822357c3874c40f5e74068458c2dc79af shows changes primarily in src/snowflake/connector/cache.py and src/snowflake/connector/ocsp_snowflake.py.

In src/snowflake/connector/cache.py, the SFDictFileCache class had methods _load and _save.

The _load method previously contained the line other: SFDictFileCache = pickle.load(r_file). This is a direct use of pickle.load on a file, which is the core of the deserialization vulnerability. If an attacker could control the content of this file, they could achieve arbitrary code execution.
The _save method previously contained the line w_file.write(pickle.dumps(self)). This method serialized the cache object using pickle.dumps before writing it to a file. This serialized data would then be consumed by the vulnerable _load method.

The patch replaces these direct pickle calls with self._deserialize and self._serialize respectively. A new class _OCSPResponseValidationResultCache (in src/snowflake/connector/ocsp_snowflake.py), which inherits from SFDictFileCache, overrides these methods to use json for serialization and deserialization, thus mitigating the vulnerability. The OCSP_RESPONSE_VALIDATION_CACHE is then instantiated using this new, safer class.

The functions SFDictFileCache._load and SFDictFileCache._save are identified as vulnerable because they were the ones directly performing the insecure pickle.load and pickle.dumps operations on the cache file before the patch.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

6.7

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-24794: snowflake-connector-python vulnerable to insecure deserialization of the OCSP response cache

Issue

Vulnerability Details

Solution

Additional Information

CVE-2025-24794:

6.7

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

6.7

6.7

Technical Details

CVE-2025-24794: snowflake-connector-python vulnerable to insecure deserialization of the OCSP response cache

Issue

Vulnerability Details

Solution

Additional Information

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI