CVE-2025-46614: Low severity snowflake odbc driver vulnerability
Published Apr 28, 2025
·Updated
In Snowflake ODBC Driver before 3.7.0, in certain code paths, the Driver logged the whole SQL query at the INFO level, aka Insertion of Sensitive Information into a Log File.
Affected Software
1 affected component
Snowflake ODBC Driver<3.7.0
Event History
Apr 28, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeakness
Oct 7, 57345
Event
via FIRST·11:20 AM
Frequently Asked Questions
1
What is the severity of CVE-2025-46614?
CVE-2025-46614 is considered a high-severity vulnerability due to the potential exposure of sensitive information in log files.
2
How do I fix CVE-2025-46614?
To fix CVE-2025-46614, you should upgrade the Snowflake ODBC Driver to version 3.7.0 or later.
3
What types of information are logged in CVE-2025-46614?
CVE-2025-46614 allows the Snowflake ODBC Driver to log entire SQL queries, which may include sensitive user data.
4
Who is affected by CVE-2025-46614?
Users of Snowflake ODBC Driver versions prior to 3.7.0 are affected by CVE-2025-46614.
5
Can CVE-2025-46614 be exploited remotely?
CVE-2025-46614 does not appear to have a specific remote exploitation vector, but sensitive information exposure can lead to indirect attacks.