8.8
CVSS CVSS_V3
Status
Justification
Impact
The vulnerability doesn't appear to be legitimate. The fix (https://github.com/snowflakedb/gosnowflake/pull/757) cannot fix any vulnerability, since it only introduces unused code. If a vulnerability exists as part of the SSO process, it would need to be addressed server side, and not in the Snowflake Golang client. Ultimately, the SSO server is responsible for determining if a redirect URL is allowed, not the client. The Go vulndb has also indicated this CVE is not a vulnerability (https://github.com/golang/vulndb/issues/1846).
Status