CVE-2023-51662 json
Snowflake Connector .NET does not properly check the Certificate Revocation List (CRL)
published 2023-12-22 2 y ago modified 2026-06-17 4 mo ago also GHSA-hwcc-4cv8-cf3h , EUVD-2023-3228
- cvss
- 6.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 28%
- public exploits
- 0
- none known
Summary
The Snowflake .NET driver provides an interface to the Microsoft .NET open source software framework for developing applications. Snowflake recently received a report about a vulnerability in the Snowflake Connector .NET where the checks against the Certificate Revocation List (CRL) were not performed where the insecureMode flag was set to false, which is the default setting. The vulnerability affects versions between 2.0.25 and 2.1.4 (inclusive). Snowflake fixed the issue in version 2.1.5.
Patch / fix
- nuget Snowflake.Data 2.1.5
- snowflake snowflake_connector 2.1.5
Exploit prediction
0.35% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.0 | CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 6.0 | CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| nuget | Snowflake.Data | >=2.0.25, <2.1.5 |
2.1.5 |
Affected products
- snowflakedb snowflake-connector-net
Classification
- Weakness
-
- CWE-295 Improper Certificate Validation
References
-
github.com
/snowflakedb/snowflake-connector-net/commit/49cb77ddd6e18c110eca35aa580e89d73c46cc33
web
-
github.com
/snowflakedb/snowflake-connector-net/security/advisories/GHSA-hwcc-4cv8-cf3h
web, vendor-advisory
-
docs.snowflake.com
/release-notes/clients-drivers/dotnet-2023#version-2-1-5-december-18-2023
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2023-51662
advisory
-
github.com
/snowflakedb/snowflake-connector-net
package
Sources
- CVE List CVE-2023-51662
- GitHub Advisory GHSA-hwcc-4cv8-cf3h
- NVD CVE-2023-51662
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.