snowflake-connector-python 3.18.0__tar.gz → 3.18.1__tar.gz

{snowflake_connector_python-3.18.0 → snowflake_connector_python-3.18.1}/DESCRIPTION.md

@@ -7,8 +7,10 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
-- v3.19.0(TBD)
-  - N/A
+- v3.18.1(July 15,2026)
+  - Improved verification of TLS connections (SNOW-3675579).
+  - Fixed FIPS environments md5 hash issues with multipart upload on Azure.
+  - Fixed a bug where Azure GET commands would incorrectly set the file status to UPLOADED instead of preserving the DOWNLOADED status during metadata retrieval.
 
 - v3.18.0(October 03,2025)
   - Added support for pandas conversion for Day-time and Year-Month Interval types

{snowflake_connector_python-3.18.0 → snowflake_connector_python-3.18.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: snowflake-connector-python
-Version: 3.18.0
+Version: 3.18.1
 Summary: Snowflake Connector for Python
 Home-page: https://www.snowflake.com/
 Author: Snowflake, Inc
@@ -86,8 +86,10 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
-- v3.19.0(TBD)
-  - N/A
+- v3.18.1(July 15,2026)
+  - Improved verification of TLS connections (SNOW-3675579).
+  - Fixed FIPS environments md5 hash issues with multipart upload on Azure.
+  - Fixed a bug where Azure GET commands would incorrectly set the file status to UPLOADED instead of preserving the DOWNLOADED status during metadata retrieval.
 
 - v3.18.0(October 03,2025)
   - Added support for pandas conversion for Day-time and Year-Month Interval types

{snowflake_connector_python-3.18.0 → snowflake_connector_python-3.18.1}/src/snowflake/connector/azure_storage_client.py

@@ -14,7 +14,7 @@ from .compat import quote
 from .constants import FileHeader, ResultStatus
 from .encryption_util import EncryptionMetadata
 from .storage_client import SnowflakeStorageClient
-from .util_text import get_md5
+from .util_text import get_md5_for_integrity
 from .vendored import requests
 
 if TYPE_CHECKING:  # pragma: no cover
@@ -124,7 +124,9 @@ class SnowflakeAzureRestClient(SnowflakeStorageClient):
         self.retry_count[retry_id] = 0
         r = self._send_request_with_authentication_and_retry("HEAD", url, retry_id)
         if r.status_code == 200:
-            meta.result_status = ResultStatus.UPLOADED
+            # If we are in download path, do not update to UPLOADED
+            if meta.result_status != ResultStatus.DOWNLOADED:
+                meta.result_status = ResultStatus.UPLOADED
             enc_data_str = r.headers.get(ENCRYPTION_DATA)
             encryption_data = None if enc_data_str is None else json.loads(enc_data_str)
             encryption_metadata = (
@@ -241,9 +243,9 @@ class SnowflakeAzureRestClient(SnowflakeStorageClient):
                 fd.close()
         headers = {
             "x-ms-blob-content-encoding": "utf-8",
-            "x-ms-blob-content-md5": base64.b64encode(get_md5(file_content)).decode(
-                "utf-8"
-            ),
+            "x-ms-blob-content-md5": base64.b64encode(
+                get_md5_for_integrity(file_content)
+            ).decode("utf-8"),
         }
         azure_metadata = self._prepare_file_metadata()
         headers.update(azure_metadata)

{snowflake_connector_python-3.18.0 → snowflake_connector_python-3.18.1}/src/snowflake/connector/pandas_tools.py

@@ -408,7 +408,7 @@ def write_pandas(
     ):
         warnings.warn(
             "Dataframe contains a datetime with timezone column, but "
-            f"'{use_logical_type=}'. This can result in dateimes "
+            f"'{use_logical_type=}'. This can result in datetimes "
             "being incorrectly written to Snowflake. Consider setting "
             "'use_logical_type = True'",
             UserWarning,

{snowflake_connector_python-3.18.0 → snowflake_connector_python-3.18.1}/src/snowflake/connector/ssl_wrap_socket.py

@@ -28,6 +28,7 @@ from .session_manager import SessionManager
 from .vendored.urllib3 import connection as connection_
 from .vendored.urllib3.contrib.pyopenssl import PyOpenSSLContext, WrappedSocket
 from .vendored.urllib3.util import ssl_ as ssl_
+from .vendored.urllib3.util.ssl_match_hostname import CertificateError, match_hostname
 
 DEFAULT_OCSP_MODE: OCSPMode = OCSPMode.FAIL_OPEN
 FEATURE_OCSP_MODE: OCSPMode = DEFAULT_OCSP_MODE
@@ -76,13 +77,79 @@ def _ensure_partial_chain_on_context(ctx: PyOpenSSLContext, cafile: str | None)
         pass
 
 
-def _build_context_with_partial_chain(cafile: str | None) -> PyOpenSSLContext:
-    """Create PyOpenSSL context configured for CERT_REQUIRED and partial-chain trust."""
+def _nonnegative_options(value: int) -> int:
+    """Return *value* as the non-negative bitmask pyOpenSSL/cryptography expects.
+
+    ``ssl.SSLContext.options`` is exposed through a signed, platform-width C
+    ``long``. On Windows that type is 32 bits, so the common default mask (which
+    has bit 31 set, e.g. ``0x82520050``) is returned as a *negative* Python int.
+    cryptography's binding marshals the value into an unsigned parameter and
+    rejects negatives with ``OverflowError: can't convert negative number to
+    unsigned`` -- which previously aborted every Windows TLS handshake the
+    moment we carried these options onto the substituted ``PyOpenSSLContext``.
+    Recover the intended unsigned 32-bit mask; values that are already
+    non-negative (every other platform) pass through unchanged.
+    """
+    return value & 0xFFFFFFFF if value < 0 else value
+
+
+def _apply_stdlib_hardening(dst: PyOpenSSLContext, src: ssl.SSLContext | None) -> None:
+    """Carry TLS hardening from a stdlib ``SSLContext`` onto ``dst``.
+
+    The connector replaces the stdlib ``ssl.SSLContext`` that urllib3 builds
+    (or that a caller supplied) with a ``PyOpenSSLContext``. Without copying the
+    original context's hardening forward, the substitution silently drops the
+    TLS-version floor and ``OP_NO_*`` options urllib3 configured and
+    any hardening a caller set on a supplied context. Copy the
+    settings we can read back; fall back to urllib3's default floor when there
+    is no source context to mirror.
+
+    Limitation: cipher restrictions and pinned CA material (``cadata`` /
+    ``load_verify_locations``) cannot be read back out of an ``ssl.SSLContext``,
+    so they cannot be transferred here. Honoring caller-supplied pinning needs a
+    dedicated, supported channel and is tracked as a follow-up.
+    """
+    if isinstance(src, ssl.SSLContext):
+        # Mirror the protocol-version floor/ceiling and OpenSSL options the
+        # original context carried (e.g. TLS 1.2 minimum, OP_NO_SSLv3,
+        # OP_NO_COMPRESSION) plus any caller hardening (e.g. VERIFY_X509_STRICT).
+        for attr in ("minimum_version", "maximum_version", "verify_flags"):
+            try:
+                setattr(dst, attr, getattr(src, attr))
+            except (ValueError, OSError, OpenSSL.SSL.Error):
+                # Best-effort; an unsupported value must not break the handshake.
+                pass
+        try:
+            dst.options |= _nonnegative_options(src.options)
+        except (ValueError, OSError, OpenSSL.SSL.Error, OverflowError, TypeError):
+            # Best-effort; carrying options forward must never break the
+            # handshake even if a value can't be marshalled into pyOpenSSL.
+            pass
+    else:
+        # No source context to mirror (no ssl_context was supplied): restore the
+        # hardening urllib3's create_urllib3_context() would have applied.
+        try:
+            dst.minimum_version = ssl.TLSVersion.TLSv1_2
+            dst.options |= ssl.OP_NO_COMPRESSION
+        except (ValueError, OSError, OpenSSL.SSL.Error, OverflowError, TypeError):
+            pass
+
+
+def _build_context_with_partial_chain(
+    cafile: str | None, src_context: ssl.SSLContext | None = None
+) -> PyOpenSSLContext:
+    """Create PyOpenSSL context configured for CERT_REQUIRED and partial-chain trust.
+
+    When ``src_context`` is the stdlib context being replaced, its TLS hardening
+    (version floor, options, verify flags) is carried forward so the
+    substitution does not weaken the connection.
+    """
     ctx = PyOpenSSLContext(ssl_.PROTOCOL_TLS_CLIENT)
     try:
         ctx.verify_mode = ssl.CERT_REQUIRED
     except Exception:
         pass
+    _apply_stdlib_hardening(ctx, src_context)
     _ensure_partial_chain_on_context(ctx, cafile)
     return ctx
 
@@ -144,6 +211,54 @@ def inject_into_urllib3() -> None:
     connection_.ssl_wrap_socket = ssl_wrap_socket_with_ocsp
 
 
+def _verify_hostname_after_handshake(
+    wrapped_socket: WrappedSocket,
+    server_hostname: str | None,
+    ssl_context: Any,
+) -> None:
+    """Match the peer certificate against *server_hostname*."""
+    # Honor explicitly-disabled certificate verification (CERT_NONE) first; when
+    # verification is off there is nothing to assert about server identity, so a
+    # missing hostname is acceptable. Check this before the hostname so we only
+    # skip when the caller genuinely opted out of verification.
+    verify_mode = getattr(ssl_context, "verify_mode", ssl.CERT_REQUIRED)
+    if verify_mode == ssl.CERT_NONE:
+        return
+
+    # Verification is required but there is no host to match against (e.g. TLS
+    # without SNI). Fail closed rather than accepting the peer: without a
+    # hostname we cannot assert server identity.
+    if not server_hostname:
+        raise CertificateError(
+            "no server hostname supplied to match against the peer certificate; "
+            "cannot verify server identity"
+        )
+
+    # Normalize bracketed / scoped IPv6 literals the same way urllib3 does:
+    # strip the brackets and drop any "%scope" suffix before testing for an IP,
+    # since Python's ssl module treats scoped addresses as DNS hostnames.
+    normalized = server_hostname.strip("[]")
+    if "%" in normalized:
+        normalized = normalized[: normalized.rfind("%")]
+    if ssl_.is_ipaddress(normalized):
+        server_hostname = normalized
+
+    cert = wrapped_socket.getpeercert()
+    try:
+        match_hostname(cert, server_hostname)
+    except CertificateError as e:
+        log.warning(
+            "Certificate did not match expected hostname: %s. Certificate: %s",
+            server_hostname,
+            cert,
+        )
+        # Attach the cert so callers catching CertificateError can inspect it,
+        # matching urllib3's own _match_hostname behavior.
+        e._peer_cert = cert
+        wrapped_socket.close()
+        raise
+
+
 @wraps(ssl_.ssl_wrap_socket)
 def ssl_wrap_socket_with_ocsp(*args: Any, **kwargs: Any) -> WrappedSocket:
     # Bind passed args/kwargs to the underlying signature to support both positional and keyword calls
@@ -158,15 +273,21 @@ def ssl_wrap_socket_with_ocsp(*args: Any, **kwargs: Any) -> WrappedSocket:
 
     # Ensure PyOpenSSL context with partial-chain is used if none or wrong type provided
     provided_ctx = params.get("ssl_context")
+    cafile_for_ctx = _resolve_cafile(params)
     if not isinstance(provided_ctx, PyOpenSSLContext):
-        cafile_for_ctx = _resolve_cafile(params)
-        params["ssl_context"] = _build_context_with_partial_chain(cafile_for_ctx)
+        # Carry the replaced stdlib context's TLS hardening forward so the
+        # substitution doesn't silently weaken the connection.
+        params["ssl_context"] = _build_context_with_partial_chain(
+            cafile_for_ctx, src_context=provided_ctx
+        )
     else:
         # If a PyOpenSSLContext is provided, ensure it trusts the provided CA and partial-chain is enabled
-        _ensure_partial_chain_on_context(provided_ctx, _resolve_cafile(params))
+        _ensure_partial_chain_on_context(provided_ctx, cafile_for_ctx)
 
     ret = ssl_.ssl_wrap_socket(**params)
 
+    _verify_hostname_after_handshake(ret, server_hostname, params.get("ssl_context"))
+
     log.debug(
         "OCSP Mode: %s, OCSP response cache file name: %s",
         FEATURE_OCSP_MODE.name,

{snowflake_connector_python-3.18.0 → snowflake_connector_python-3.18.1}/src/snowflake/connector/util_text.py

@@ -293,9 +293,11 @@ def _base64_bytes_to_str(x) -> str | None:
     return base64.b64encode(x).decode("utf-8") if x else None
 
 
-def get_md5(text: str | bytes) -> bytes:
+def get_md5_for_integrity(text: str | bytes) -> bytes:
+    # MD5 should not be used for security reasons - only integrity is safe and allowed
     if isinstance(text, str):
         text = text.encode("utf-8")
-    md5 = hashlib.md5()
+    # Usedforsecurity=False added to support FIPS envs as well
+    md5 = hashlib.md5(usedforsecurity=False)
     md5.update(text)
     return md5.digest()

{snowflake_connector_python-3.18.0 → snowflake_connector_python-3.18.1}/src/snowflake/connector/version.py

@@ -1,3 +1,3 @@
 # Update this for the versions
 # Don't change the forth version number from None
-VERSION = (3, 18, 0, None)
+VERSION = (3, 18, 1, None)

{snowflake_connector_python-3.18.0 → snowflake_connector_python-3.18.1}/src/snowflake_connector_python.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: snowflake-connector-python
-Version: 3.18.0
+Version: 3.18.1
 Summary: Snowflake Connector for Python
 Home-page: https://www.snowflake.com/
 Author: Snowflake, Inc
@@ -86,8 +86,10 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
-- v3.19.0(TBD)
-  - N/A
+- v3.18.1(July 15,2026)
+  - Improved verification of TLS connections (SNOW-3675579).
+  - Fixed FIPS environments md5 hash issues with multipart upload on Azure.
+  - Fixed a bug where Azure GET commands would incorrectly set the file status to UPLOADED instead of preserving the DOWNLOADED status during metadata retrieval.
 
 - v3.18.0(October 03,2025)
   - Added support for pandas conversion for Day-time and Year-Month Interval types