Advisoriesby IbisRetrying of malformed requests
Issue
Snowflake discovered and remediated a vulnerability in the Snowflake Connector for C/C++ (“Connector”). Malformed requests that caused the HTTP response status code 400 were incorrectly treated as retryable. This could hang the application until SF_CON_MAX_RETRY requests were sent.
This vulnerability affects Connector versions 0.5.0 through 2.1.0. Snowflake fixed the issue in version 2.2.0.
Vulnerability Details
The HTTP response status code 400 was incorrectly treated by the Connector as a retryable error. This caused malformed requests to be retried SF_CON_MAX_RETRY times (by default 7), hanging the application until all attempts were exhausted.
Solution
Snowflake released version 2.2.0 of the Snowflake Connector for C/C++, which fixes this issue. We recommend users upgrade to version 2.2.0.
Additional Information
If you discover a security vulnerability in one of our products or websites, please report the issue to Snowflake through our Vulnerability Disclosure Program hosted at HackerOne. For more information, please see our [Vulnerability Disclosure Policy](https://hackerone.com/snowflake?type=team).
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| libsnowflakeclient Product | >= 0.5.0, < 2.2.0 | 2.2.0 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-573