CVE-2024-43382: snowflake snowflake_jdbc Inadequate Encryption Strength
CVSS: 5.9v3.1MediumAnalyzed
AliasesCGA-22g7-8vvh-2xj6CGA-2cq8-wm2h-wjpmCGA-2h97-vc27-3vcgCGA-32x8-v766-89r7CGA-34q2-hj53-4qwqCGA-35gw-93gr-fwx2CGA-37wx-qwwg-f46xCGA-3chj-vj62-4q3pCGA-3mp2-633g-ppw9CGA-3wx4-jp79-j59pCGA-49c9-9qxj-vhfmCGA-4cfw-8x73-cr52CGA-4f59-4vh6-47jmCGA-4qvm-g3xc-f386CGA-4r6r-7ppq-5986CGA-4wxj-hcvg-j65qCGA-537v-8337-9prwCGA-54v8-r964-hmccCGA-55xf-38q8-f23gCGA-57g2-xph5-pfrfCGA-62fp-5ghq-v3q7CGA-62gq-rp55-w747CGA-64qx-6q63-qff4CGA-67v6-j78w-hppgCGA-68f3-9cfp-hwr9CGA-6gf3-47x6-89wcCGA-6gh4-gwxv-2p2pCGA-6mjf-r4x7-q63jCGA-6q9g-ph8w-rxxqCGA-6r8r-jpg2-5x7xCGA-6vcq-f434-ch3rCGA-6xjp-rmfp-88ffCGA-6xjw-pmp3-29g8CGA-74w2-r8c6-rcg4CGA-75pw-pq7r-6h5xCGA-78cr-477g-rmfwCGA-7hx7-q4vx-jh6qCGA-7q9q-hfmg-6f74CGA-7vpw-gpgj-qg5vCGA-847r-v724-jx5rCGA-8jg2-wwfc-m52hCGA-8r9c-gc3g-wgm7CGA-8wc6-f972-qgrcCGA-92wg-gx49-99gqCGA-92wm-8pxh-gfgqCGA-96pj-5h3j-p7v6CGA-9f5g-7c5c-933mCGA-9jp4-ph99-hh46CGA-9vqq-5mhv-53jhCGA-c26p-vp4x-pfxwCGA-c2q7-w4vx-2xg7CGA-c67c-fx8m-m438CGA-c68f-8qhg-645rCGA-cpwg-jxhq-56xcCGA-cqgv-4jhc-wxc7CGA-cvm7-mrh6-jc98CGA-cw8h-g35g-9hrwCGA-cwwm-p37c-7qm5CGA-cxw6-hjv4-g758CGA-f3m8-h7h6-q5xqCGA-f95r-2qh9-6p4jCGA-fqgg-8p7w-288pCGA-g7gg-c7gj-m775CGA-ghp6-9xgg-v7cxCGA-grqv-cmwx-48q5CGA-h2j7-pvgr-j339CGA-h3xp-28xv-3rwgCGA-h7mc-v986-gx9qCGA-hj8r-4rrq-9x2vCGA-hm97-4vg9-rpqjCGA-j49v-fgjm-vj8hCGA-j984-pq9j-6383CGA-jh83-x39w-f4frCGA-jmr4-6gj5-5g29CGA-jpcp-p539-j3mwCGA-jv9j-xqq6-95rfCGA-m5p9-g26h-3527CGA-mg5v-fq4j-hj94CGA-mmcr-xfhq-ghrpCGA-mpmw-8w6f-556hCGA-mpwr-7pr6-8h76CGA-mq2w-m89p-7gcvCGA-mwcp-w9qq-rfr9CGA-mwwr-v42r-q47pCGA-phqc-px7h-99m7CGA-phx9-x43c-74hxCGA-pjx5-v5xc-8vwcCGA-pp47-c89c-3x3xCGA-prhq-gc8v-29h9CGA-pwcm-2cc9-fgwqCGA-px77-h46p-jgh9CGA-px9m-qxm9-ff84CGA-q2px-pvwm-fx52CGA-q6m8-fqxq-8rj6CGA-q8mm-95jc-j549CGA-qgpv-362m-m9hvCGA-qh7x-m726-qvfwCGA-r35p-rqwj-6pv4CGA-r3h8-fhwf-2794CGA-r7xj-gh24-9j4vCGA-r86f-2wcm-c5gqCGA-rh7j-v376-xpmvCGA-rhpf-8vh2-wqq2CGA-rrjc-f2j8-cv3jCGA-rvjq-hq9j-7chxCGA-rx42-jvrm-jh5rCGA-v825-7999-j677CGA-vjc2-wwgg-367hCGA-vmx5-9v4q-fg77CGA-vphx-x7vc-rvmjCGA-vvmw-96qq-j589CGA-wmv5-83ph-2wr8CGA-x42w-ff38-f5wqCGA-x5hh-8285-r9r4CGA-x77q-hrhf-4p37CGA-xcjp-p3wc-r724CGA-xfw8-gjw2-wg8jCGA-xpg4-2pxg-x8gxGHSA-f686-hw9c-xw9c
Published 30-10-2024Last modified 31-10-2024
Vulnerability summary
CVE-2024-43382 is a medium (CVSS 5.9) Inadequate Encryption Strength vulnerability in snowflake snowflake_jdbc. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 6.6% of scored vulnerabilities.
CVSS score
5.9/10
010
Medium · v3.1 (CVE.org)EPSS score
0.18%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 2Timeline
- 30-10-2024PublishedVulnerability first disclosed.
- 31-10-2024Last modifiedVulnerability information updated.
Description
Snowflake JDBC driver versions >= 3.2.6 and <= 3.19.1 have an Incorrect Security Setting that can result in data being uploaded to an encrypted stage without the additional layer of protection provided by client side encryption.
CVSS metrics
6 scores · 5 sources · 2 versionsHigh 7.4Preferred score · OSV · Maven (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:PSourcesSingle source
Medium 5.9Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:NSourcesAll 5 agree
- OSV · WolfiEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
- OSV · MavenEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
- NVDNIST5.9MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
0.18%
Chance of exploitation in the next 30 days
Percentile
7%
Versus all other CVEs
30-day change
0.00 pp
From 0.18% on 19-09-2026
19-09-202619-10-2026
EPSS score0.18%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard59 products
- trino< 472-r0
- trino-config< 472-r0
- trino-oci-entrypoint< 472-r0
- trino-plugin-ai-functions< 472-r0
- trino-plugin-bigquery< 472-r0
Wolfi59 products
- trino< 472-r0
- trino-config< 472-r0
- trino-oci-entrypoint< 472-r0
- trino-plugin-ai-functions< 472-r0
- trino-plugin-bigquery< 472-r0
Net.snowflake1 product
- snowflake-jdbc≥ 3.2.6, < 3.20.0
Snowflake1 product
- snowflake_jdbc≥ 3.2.6, < 3.20.0
4 vendors · 120 products
References
4 links- github.com/snowflakedb/snowflake-jdbc/security/advisories/GHSA-f686-hw9c-xw9cAdvisoryWEBVendor Advisory
