GHSA-4r6j-fwcx-94cf

snowflake-connector-python is vulnerable to Regular Expression Denial of Service (ReDoS)

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-42965

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	snowflake-connector-python	< 2.8.2	2.8.2

Details

As written in the advisory (Markdown source, shown as plain text).

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the snowflake-connector-python PyPI package, when an attacker is able to supply arbitrary input to the get_file_transfer_type method.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-42965 advisory
https://github.com/snowflakedb/snowflake-connector-python/pull/1327 web
https://github.com/snowflakedb/snowflake-connector-python/commit/b9d2fc789fae4db865dde3d2a1bd72c8a9eab091 web
https://github.com/snowflakedb/snowflake-connector-python package
https://github.com/snowflakedb/snowflake-connector-python/releases/tag/v2.8.2 web
https://research.jfrog.com/vulnerabilities/snowflake-connector-python-redos-xray-257185 web