Snowflake Connector for Python OCSP Response Cache Deserialization Vulnerability Leading to Privilege Escalation

A vulnerability exists in the Snowflake Connector for Python, specifically in versions 2.7.12 through 3.13.0, where the OCSP response cache is serialized using pickle. This serialization method can be exploited to achieve local privilege escalation, particularly if an attacker can write to the OCSP response cache file.

Impact

Exploitation of this vulnerability could result in local privilege escalation, allowing an attacker to gain elevated rights on the machine running the Snowflake Connector for Python.

Reproduction

The vulnerability can be reproduced by using the Snowflake Connector for Python versions 2.7.12 to 3.13.0. The OCSP response cache will be serialized with pickle, creating a risk of privilege escalation if the cache file is writable.

Remediation

Users are advised to upgrade to version 3.13.1 of the Snowflake Connector for Python, which addresses this vulnerability.