CVE-2022-42965: 
Python vulnerability analysis and mitigation

An exponential ReDoS (Regular Expression Denial of Service) vulnerability was discovered in the snowflake-connector-python PyPI package, identified as CVE-2022-42965. The vulnerability was discovered on October 15, 2022, and affects snowflake-connector-python versions up to and including 2.8.1. The issue occurs when an attacker can supply arbitrary input to the undocumented getfiletransfer_type method (JFrog Research).

The vulnerability has been assigned a CVSS v3.1 score of 7.5 (HIGH) and is classified under CWE-1333. The issue specifically involves an exponential Regular Expression Denial of Service (ReDoS) that can be triggered through the undocumented getfiletransfer_type method in the SnowflakeCursor class (NVD, JFrog Research).

When exploited, this vulnerability can lead to denial of service conditions in applications using the affected versions of the Snowflake Python Connector package. The impact is particularly relevant for applications that leverage the undocumented and unsupported internal function SnowflakeCursor (Snowflake Community).

The vulnerability has been fixed in version 2.8.2 of the snowflake-connector-python package. Users are advised to upgrade to this version or later to address the security issue. No alternative mitigations have been provided for this vulnerability (JFrog Research).