-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| snowflake-connector-python | pip | >= 2.3.7, <= 3.13.0 | 3.13.1 |
Miggo AIRoot Cause AnalysisThe vulnerability (GHSA-r2x6-cjg7-8r43 / CVE-2025-24795) is due to insecure default file permissions (CWE-276) when caching temporary credentials and potentially other temporary files. The provided commit 3769b43822357c3874c40f5e74068458c2dc79af addresses this by modifying how files are created and opened.
The primary function highlighted by the advisory is flush_temporary_credentials in src/snowflake/connector/auth/_auth.py, which directly handles the caching of temporary credentials. The patch modifies its open() call to use a new owner_rw_opener, which sets file permissions to 0o600 (owner read/write only).
Additionally, the same commit applies similar fixes to other functions that create or handle temporary/intermediate files:
decrypt_file in src/snowflake/connector/encryption_util.py was updated to use owner_rw_opener for its temporary output file.prepare_download and write_downloaded_chunk in src/snowflake/connector/storage_client.py (part of SnowflakeRemoteStorageUtil class) were updated to use a new internal helper _open_intermediate_dst_path. This helper ensures that the intermediate download file is created with mode=0o600 using Path.touch(mode=0o600) before being opened.These changes indicate that all these functions were previously creating files relying on default system permissions, which could be overly permissive (e.g., world-readable on Linux as stated for the credential cache). Therefore, they are all considered vulnerable in the context of CWE-276, and the patch remediates this by enforcing secure permissions (0o600) at the time of file creation or first open.
PythonPythonOngoing coverage of React2Shell