Snowflake PHP PDO Driver Signed-to-Unsigned Conversion Error Vulnerability Leading to Application Crash

A vulnerability exists in the Snowflake PHP PDO Driver, specifically in versions 0.2.0 through 3.0.3. The issue arises when unsupported queries, such as PUT or GET operations on stages, are executed. The driver fails to properly handle the return value of these queries, misinterpreting an error code as the number of returned columns. This oversight leads to a signed-to-unsigned conversion error, causing a PHP runtime error that crashes the application using the driver. Snowflake has addressed this vulnerability in version 3.1.0.

Impact

Exploitation of this vulnerability causes a PHP runtime error that crashes the application utilizing the Snowflake PHP PDO Driver.

Remediation

Users are advised to upgrade to version 3.1.0 of the Snowflake PHP PDO Driver, which addresses this vulnerability.