Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

snowflakedb/snowflake-jdbc

              master @ 4b4df3a
            

Fixes

CVEs

HIGH

Peak severity

0.0%

Coverage

Highlights

Auth Bypass: 2 prior fixes. Scrutinize any change in this area.

net.snowflake.client.internal.jdbc.cloud.storage: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: Cloud storage download clients (S3, Azure, GCS) resolved destination paths without verification, allowing directory traversal and arbitrary file writes when downloading files to the local file system. Developers must enforce strict canonical path validation against the target directory before writing to disk.

Auth Bypass: Improper caching of HTTP clients caused OCSP certificate revocation checks to bypass per-connection proxy settings. This could allow connections to be established via incorrect routing or with incomplete revocation validation.

Auth Bypass: Proxy authentication credentials were not properly propagated or enforced when establishing connections to Google Cloud Storage (GCS), leading to missing or incorrect proxy authentication.