VYPR
← All advisories
Moderate severityNVD Advisory· Published Oct 30, 2024· Updated Oct 31, 2024

CVE-2024-43382

CVE-2024-43382

Description

Snowflake JDBC driver versions >= 3.2.6 and <= 3.19.1 have an Incorrect Security Setting that can result in data being uploaded to an encrypted stage without the additional layer of protection provided by client side encryption.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Snowflake JDBC driver versions 3.2.6 to 3.19.1 have an incorrect security setting that bypasses client-side encryption for stages on Azure and GCP with 256-bit key size.

Vulnerability

Description

CVE-2024-43382 is an incorrect security setting in the Snowflake JDBC driver that can result in data being uploaded to an encrypted stage without the additional layer of protection provided by client-side encryption [1][3]. This issue affects driver versions >=3.2.6 and <=3.19.1, but only manifests in specific configurations: accounts hosted on Azure or Google Cloud Platform (GCP) deployments where the CLIENT_ENCRYPTION_KEY_SIZE account parameter is set to 256-bit instead of the default 128-bit [3]. AWS deployments are not affected [3].

Exploitation

Conditions

To exploit this vulnerability, an attacker must have access to a Snowflake account using a vulnerable JDBC driver version and with a non-default encryption key size setting [3]. The data remains protected by TLS in transit and server-side encryption at rest, so the missing layer is the additional client-side encryption [3]. The issue is not visible to customers and does not result in data exposure beyond the lack of this extra protection [3].

Impact

The impact is that data may lack the additional encryption layer intended by client-side encryption, though it is still secured by TLS and server-side encryption [3]. The severity is assessed as medium with a CVSSv3 base score of 5.9 [3].

Mitigation

Snowflake released a patch in JDBC driver version 3.20.0 on October 28, 2024, which fixes the incorrect security setting [3]. Users are strongly recommended to upgrade to 3.20.0 or later versions as soon as possible [3].

References
  1. NVD - CVE-2024-43382
  2. 2024-8-14 Snowflake JDBC Security Advisory

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
net.snowflake:snowflake-jdbcMaven
>= 3.2.6, < 3.20.03.20.0

Affected products

136

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

3

News mentions

0

No linked articles in our index yet.