CVE-2023-51662
Snowflake Connector .NET does not properly check the Certificate Revocation List (CRL)
- State
- Published
- Severity
- 6.0 Medium
- Published
- Dec 22, 2023
- Updated
- Aug 2, 2024
- Reserved
- Dec 21, 2023
Description
The Snowflake .NET driver provides an interface to the Microsoft .NET open source software framework for developing applications. Snowflake recently received a report about a vulnerability in the Snowflake Connector .NET where the checks against the Certificate Revocation List (CRL) were not performed where the insecureMode flag was set to false, which is the default setting. The vulnerability affects versions between 2.0.25 and 2.1.4 (inclusive). Snowflake fixed the issue in version 2.1.5.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.0 Medium | CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L | GitHub_M |
Weaknesses
- CWE-295 Improper Certificate Validation
Affected Products
| Product | Versions |
|---|---|
snowflake-connector-netsnowflakedb |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.