7.8

CVE-2025-24794: snowflake snowflake_connector Deserialization of Untrusted Data

CVSS: 7.8v3.1HighAnalyzed
AliasesGHSA-m4f6-vcj4-w5mxPYSEC-2025-27CGA-3fc5-gm29-jfvr
Published 29-01-2025Last modified 31-01-2025
Open JSON

Vulnerability summary

CVE-2025-24794 is a high (CVSS 7.8) Deserialization of Untrusted Data vulnerability in snowflake snowflake_connector. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 15.4% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (NVD)
EPSS score
0.25%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 2
CGA-F69P-9RG2-8GQJCGA-X5X6-C78P-M73X

Timeline

  1. 29-01-2025
    PublishedVulnerability first disclosed.
  2. 31-01-2025
    Last modifiedVulnerability information updated.

Description

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. The OCSP response cache uses pickle as the serialization format, potentially leading to local privilege escalation. This vulnerability affects versions 2.7.12 through 3.13.0. Snowflake fixed the issue in version 3.13.1.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.25%

Chance of exploitation in the next 30 days

Percentile

15%

Versus all other CVEs

30-day change

0.00 pp

From 0.25% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.25%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard2 products
  • airflow< 2.10.5-r0
  • airflow-bitnami-compat< 2.10.5-r0
Wolfi2 products
  • airflow< 2.10.5-r0
  • airflow-bitnami-compat< 2.10.5-r0
PyPI1 product
  • snowflake-connector-python< 3769b43822357c3874c40f5e74068458c2dc79af | ≥ 2.7.12, < 3.13.1
Snowflake1 product
Snowflakedb1 product

5 vendors · 7 products

References

7 links