Snowflake Connector For Python Universal Core
Monthly
SQL injection in the Snowflake Connector for Python and Snowflake Connector for Python (Universal Core) can let unauthenticated remote attackers chain additional SQL through crafted DataFrame column names passed to write_pandas(), potentially reading, modifying, or deleting data available to the application's Snowflake role. Exploitation requires a non-default configuration in which identifier escaping is disabled and an application that routes attacker-controlled column names into write_pandas(); default installations with identifier escaping enabled are not exploitable. No public exploit has been identified at time of analysis, and the vendor has released fixes in Connector for Python 4.8.1 and Universal Core 5.2.0, which users must apply manually.
SQL injection in the Snowflake Connector for Python and Snowflake Connector for Python (Universal Core) can let unauthenticated remote attackers chain additional SQL through crafted DataFrame column names passed to write_pandas(), potentially reading, modifying, or deleting data available to the application's Snowflake role. Exploitation requires a non-default configuration in which identifier escaping is disabled and an application that routes attacker-controlled column names into write_pandas(); default installations with identifier escaping enabled are not exploitable. No public exploit has been identified at time of analysis, and the vendor has released fixes in Connector for Python 4.8.1 and Universal Core 5.2.0, which users must apply manually.