Insertion of Sensitive Information into Log File Affecting net.snowflake:snowflake-jdbc package, versions [3.0.13,3.23.1)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Insertion of Sensitive Information into Log File vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-JAVA-NETSNOWFLAKE-9404321
- published14 Mar 2025
- disclosed13 Mar 2025
- creditUnknown
Introduced: 13 Mar 2025
NewCVE-2025-27496 (opens in a new tab)How to fix?
Upgrade net.snowflake:snowflake-jdbc to version 3.23.1 or higher.
Overview
Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File. When the logging level is set to DEBUG, the client-side encryption master key of the target stage is logged locally in a JSON object under the queryStageMasterKey key during the execution of GET/PUT commands.
Note:
This key by itself does not grant access to any sensitive data without additional access authorizations, and is not logged server-side by Snowflake.