Detections
Analytics
SCA: security update for net.snowflake:snowflake-jdbc (GHSA-q298-375f-5q63)
low Tenable Cloud Security Plugin ID 421122
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Snowflake, a platform for using artificial intelligence in the context of cloud computing, has a
vulnerability in the Snowflake JDBC driver ("Driver") in versions 3.0.13 through 3.23.0 of the driver.
When the logging level was set to DEBUG, the Driver would log locally the client-side encryption master
key of the target stage during the execution of GET/PUT commands. This key by itself does not grant access
to any sensitive data without additional access authorizations, and is not logged server-side by
Snowflake. Snowflake fixed the issue in version 3.23.1. (CVE-2025-27496)
See Also
Plugin Details
Severity: Low
ID: 421122
Version: Revision 1.10
Type: Local
Family: SCA Checks
Published: 3/14/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 1.2
Percentile: 0.01
Vendor
Vendor Severity: Low
CVSS v2
Risk Factor: Low
Base Score: 1.7
Temporal Score: 1.3
Vector: CVSS2#AV:L/AC:L/Au:S/C:P/I:N/A:N
CVSS Score Source: CVE-2025-27496
CVSS v3
Risk Factor: Low
Base Score: 3.3
Temporal Score: 2.9
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 3/13/2025
Vulnerability Publication Date: 3/13/2025
Reference Information
CVE: CVE-2025-27496
cwe: CWE-532