Vulnerability · Published Jan 29, 2025 · Assigned by GitHub_M

CVE-2025-24792Snowflake PHP PDO Driver has a Signed-to-Unsigned Conversion Error

Medium 4.4

In plain English

A medium-severity security flaw in pdo_snowflake from snowflakedb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 3.1)4.4Medium

Exploit odds (30 days)0.1%top 97.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Snowflake PHP PDO Driver is a driver that uses the PHP Data Objects (PDO) extension to connect to the Snowflake database. Snowflake discovered and remediated a vulnerability in the Snowflake PHP PDO Driver where executing unsupported queries like PUT or GET on stages causes a signed-to-unsigned conversion error that crashes the application using the Driver. This vulnerability affects versions 0.2.0 through 3.0.3. Snowflake fixed the issue in version 3.1.0.

Affected products (as reported)

Vendor	Product	Versions
snowflakedb	pdo_snowflake	>= 0.2.0, < 3.1.0

Weakness: CWE-195 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

References

https://github.com/snowflakedb/pdo_snowflake/security/advisories/GHSA-f8q2-7fv5-cg93 x_refsource_CONFIRM