CVE-2022-42965: Exponential ReDoS in snowflake-connector-python leads to denial of service
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the snowflake-connector-python PyPI package, when an attacker is able to supply arbitrary input to the getfiletransfertype method.
Other sources
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the snowflake-connector-python PyPI package, when an attacker is able to supply arbitrary input to the undocumented getfiletransfertype method
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/snowflake-connector-pythonto a version that resolves this vulnerability.Fixed in 2.8.2
Event History
Frequently Asked Questions
What is the severity of CVE-2022-42965?
CVE-2022-42965 has a severity rating that indicates a medium risk due to the potential for Denial of Service.
How do I fix CVE-2022-42965?
To fix CVE-2022-42965, upgrade the snowflake-connector-python package to version 2.8.2 or later.
What type of vulnerability is CVE-2022-42965?
CVE-2022-42965 is an exponential Regular Expression Denial of Service (ReDoS) vulnerability.
Which versions of snowflake-connector-python are affected by CVE-2022-42965?
CVE-2022-42965 affects all versions of snowflake-connector-python up to, but not including, version 2.8.2.
What method can trigger the vulnerability in CVE-2022-42965?
The vulnerability in CVE-2022-42965 can be triggered in the get_file_transfer_type method when arbitrary input is supplied by an attacker.