Vulnerability · Published Dec 22, 2023 · Assigned by GitHub_M

CVE-2023-51662Snowflake Connector .NET does not properly check the Certificate Revocation List (CRL)

Medium 6.0

In plain English

A medium-severity improper certificate validation in snowflake-connector-net from snowflakedb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.0Medium

Exploit odds (30 days)0.3%top 71.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The Snowflake .NET driver provides an interface to the Microsoft .NET open source software framework for developing applications. Snowflake recently received a report about a vulnerability in the Snowflake Connector .NET where the checks against the Certificate Revocation List (CRL) were not performed where the insecureMode flag was set to false, which is the default setting. The vulnerability affects versions between 2.0.25 and 2.1.4 (inclusive). Snowflake fixed the issue in version 2.1.5.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
NuGet	snowflake.data	2.1.5	GHSA-hwcc-4cv8-cf3h

Affected products (as reported)

Vendor	Product	Versions
snowflakedb	snowflake-connector-net	>= 2.0.25, <= 2.1.4

Weakness: CWE-295 · Vector: CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L

References

https://github.com/snowflakedb/snowflake-connector-net/security/advisories/GHSA-hwcc-4cv8-cf3h x_refsource_CONFIRM
https://docs.snowflake.com/release-notes/clients-drivers/dotnet-2023#version-2-1-5-december-18-2023 x_refsource_MISC