Signed-to-Unsigned Conversion Error

Medium4.4CVE-2025-24792 · Published Jan 29, 2025

### Issue Snowflake discovered and remediated a vulnerability in the Snowflake PHP PDO Driver where executing unsupported queries like PUT or GET on stages causes a signed-to-unsigned conversion error that crashes the application using the Driver. This vulnerability affects versions 0.2.0 through 3.0.3. Snowflake fixed the issue in version 3.1.0. ### Vulnerability Details When executing unsupported queries like PUT or GET on stages, the Driver doesn’t check the return value for an error code and instead treats it as the number of returned columns. Because the error code is equal to -1, it causes a PHP runtime error when it is casted to size_t and used to allocate memory. This runtime error crashes the application using the Driver. ### Solution Snowflake released version 3.1.0 of the Snowflake PHP PDO Driver, which fixes this issue. We recommend users upgrade to version 3.1.0. ### Additional Information If you discover a security vulnerability in one of our products or websites, please report the issue to HackerOne. For more information, please see our [Vulnerability Disclosure Policy](https://hackerone.com/snowflake?type=team).