fix(deps): Update module github.com/snowflakedb/gosnowflake to v1.13.3 [SECURITY]#20661
Merged
kodiakhq[bot] merged 1 commit intomainfrom Apr 28, 2025
Conversation
Contributor
Author
ℹ Artifact update noticeFile name: plugins/destination/snowflake/go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
Contributor
Author
|
/gen sha=ac7837f3dcf7d2bf293ccd6124a1c2ff71d18d0c dir=plugins/destination/snowflake |
kodiakhq bot
pushed a commit
that referenced
this pull request
Apr 29, 2025
🤖 I have created a release *beep* *boop* --- ## [4.4.15](plugins-destination-snowflake-v4.4.14...plugins-destination-snowflake-v4.4.15) (2025-04-29) ### Bug Fixes * **deps:** Update module github.com/cloudquery/plugin-sdk/v4 to v4.79.0 ([#20636](#20636)) ([1ee4f97](1ee4f97)) * **deps:** Update module github.com/snowflakedb/gosnowflake to v1.13.3 [SECURITY] ([#20661](#20661)) ([dbaa2ea](dbaa2ea)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.12.1->v1.13.3Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2025-46327
Issue
Snowflake discovered and remediated a vulnerability in the Go Snowflake Driver (“Driver”). When using the Easy Logging feature on Linux and macOS, the Driver didn’t correctly verify the permissions of the logging configuration file, potentially allowing an attacker with local access to overwrite the configuration and gain control over logging level and output location.
This vulnerability affects Driver versions from 1.7.0 up to, but not including, 1.13.3. Snowflake fixed the issue in version 1.13.3.
Vulnerability Details
When using the Easy Logging feature on Linux and macOS, the Driver reads logging configuration from a user-provided file. On Linux and macOS the Driver verifies that the configuration file can be written to only by its owner. That check was vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition and failed to verify that the file owner matches the user running the Driver. This could allow a local attacker with write access to the configuration file or the directory containing it to overwrite the configuration and gain control over logging level and output location.
Solution
Snowflake released version 1.13.3 of the Go Snowflake Driver, which fixes this issue. We recommend users upgrade to version 1.13.3.
Additional Information
If you discover a security vulnerability in one of our products or websites, please report the issue to Snowflake through our Vulnerability Disclosure Program hosted at HackerOne. For more information, please see our Vulnerability Disclosure Policy.
Release Notes
snowflakedb/gosnowflake (github.com/snowflakedb/gosnowflake)
v1.13.3: ReleaseCompare Source
v1.13.2: ReleaseCompare Source
v1.13.1: ReleaseCompare Source
v1.13.0: ReleaseCompare Source
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.