Snowflake JDBC Driver Client-Side Encryption Key Logging Vulnerability

A vulnerability exists in the Snowflake JDBC driver, specifically in versions 3.0.13 through 3.23.0. When the logging level was set to DEBUG, the driver would locally log the client-side encryption master key for the target stage during GET and PUT operations. This key, while sensitive, does not provide access to any data without additional authorizations and is not logged on the server side by Snowflake.

Impact

Logging of the client-side encryption master key in DEBUG mode, potentially leading to unauthorized access if the key is misused.

Reproduction

To reproduce this vulnerability, use the Snowflake JDBC driver version 3.0.13 to 3.23.0 and set the logging level to DEBUG. During the execution of GET or PUT commands, the client-side encryption master key will be logged locally.

Remediation

Upgrade to Snowflake JDBC driver version 3.23.1, which addresses this vulnerability by removing the encryption key from the logs.