CVE-2024-43382: 
Java vulnerability analysis and mitigation

Snowflake JDBC driver versions >= 3.2.6 and <= 3.19.1 contain an Incorrect Security Setting vulnerability that can result in data being uploaded to an encrypted stage without the additional layer of protection provided by client side encryption. The vulnerability was discovered on July 23, 2024, and affects a subset of accounts hosted on Azure and GCP deployments, specifically when customers create a stage using a JDBC driver with the CLIENT_ENCRYPTION_KEY_SIZE account parameter set to 256-bit rather than the default 128-bit (GitHub Advisory).

The vulnerability has been assigned CVE-2024-43382 with a CVSS v3.1 base score of 5.9 (Medium). The attack vector is Network-based with High attack complexity, requiring High privileges, and no user interaction. The scope is Unchanged, with High impact on both Confidentiality and Integrity, but no impact on Availability. The vulnerability is specifically related to an incorrect security setting that affects the client-side encryption layer, although data remains protected by TLS in transit and server-side encryption at rest (GitHub Advisory).

The vulnerability affects the additional layer of protection provided by client-side encryption for data uploaded to encrypted stages. While the data remains protected by TLS in transit and server-side encryption at rest, the missed layer of additional protection is not visible to affected customers. This primarily impacts accounts hosted on Azure and GCP deployments when using the specified JDBC driver versions with a 256-bit CLIENT_ENCRYPTION_KEY_SIZE parameter (GitHub Advisory).

The vulnerability requires high privileges and network access to exploit. AWS deployments are not affected by this vulnerability. The exploitation specifically occurs in scenarios where users with accounts on Azure and GCP deployments set the parameter CLIENT_ENCRYPTION_KEY_SIZE = 256 (GitHub Advisory).

Snowflake has released a patch in Snowflake JDBC driver Version 3.20.0 on October 28, 2024, that fixes the incorrect security setting. Users are strongly recommended to upgrade to version 3.20.0 or later as soon as possible (GitHub Advisory).