PYSEC-2024-66
Vulnerability from pysec - Published: 2024-07-16 23:15 - Updated: 2024-07-19 17:21
VLAI?
Details
dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. When a user installs a package in dbt, it has the ability to override macros, materializations, and other core components of dbt. This is by design, as it allows packages to extend and customize dbt's functionality. However, this also means that a malicious package could potentially override these components with harmful code. This issue has been fixed in versions 1.8.0, 1.6.14 and 1.7.14. Users are advised to upgrade. There are no kn own workarounds for this vulnerability. Users updating to either 1.6.14 or 1.7.14 will need to set flags.require_explicit_package_overrides_for_builtin_materializations: False in their configuration in dbt_project.yml.
Severity ?
7.8 (High)
Impacted products
| Name | purl | dbt-core | pkg:pypi/dbt-core |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "dbt-core",
"purl": "pkg:pypi/dbt-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3c82a0296d227cb1be295356df314c11716f4ff6"
},
{
"fixed": "87ac4deb00cc9fe334706e42a365903a1d581624"
}
],
"repo": "https://github.com/dbt-labs/dbt-core",
"type": "GIT"
},
{
"events": [
{
"introduced": "1.7.0"
},
{
"fixed": "1.7.14"
},
{
"introduced": "0"
},
{
"fixed": "1.6.14"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.13.0",
"0.13.0a1",
"0.13.0a2",
"0.13.0rc1",
"0.13.1",
"0.13.1a1",
"0.13.1a2",
"0.14.0",
"0.14.0a1",
"0.14.0a2",
"0.14.0rc1",
"0.14.1",
"0.14.1a1",
"0.14.1rc1",
"0.14.1rc2",
"0.14.2",
"0.14.3",
"0.14.3rc1",
"0.14.4",
"0.15.0",
"0.15.0b1",
"0.15.0b2",
"0.15.0b3",
"0.15.0rc1",
"0.15.0rc2",
"0.15.1",
"0.15.1rc1",
"0.15.1rc2",
"0.15.2",
"0.15.3",
"0.15.3rc1",
"0.16.0",
"0.16.0b1",
"0.16.0b2",
"0.16.0b3",
"0.16.0rc1",
"0.16.0rc2",
"0.16.0rc3",
"0.16.0rc4",
"0.16.1",
"0.16.1rc1",
"0.17.0",
"0.17.0b1",
"0.17.0b2",
"0.17.0rc1",
"0.17.0rc2",
"0.17.0rc3",
"0.17.0rc4",
"0.17.1",
"0.17.1rc1",
"0.17.1rc2",
"0.17.1rc3",
"0.17.1rc4",
"0.17.2",
"0.17.2b1",
"0.17.2rc1",
"0.18.0",
"0.18.0b1",
"0.18.0b2",
"0.18.0rc1",
"0.18.0rc2",
"0.18.1",
"0.18.1b1",
"0.18.1b2",
"0.18.1b3",
"0.18.1rc1",
"0.18.2",
"0.18.2rc1",
"0.19.0",
"0.19.0b1",
"0.19.0rc1",
"0.19.0rc2",
"0.19.0rc3",
"0.19.1",
"0.19.1b2",
"0.19.1rc1",
"0.19.1rc2",
"0.19.2",
"0.19.2rc1",
"0.19.2rc2",
"0.20.0",
"0.20.0b1",
"0.20.0rc1",
"0.20.0rc2",
"0.20.1",
"0.20.1rc1",
"0.20.2",
"0.20.2rc1",
"0.20.2rc2",
"0.21.0",
"0.21.0b1",
"0.21.0b2",
"0.21.0rc1",
"0.21.0rc2",
"0.21.1",
"0.21.1rc1",
"0.21.1rc2",
"1.0.0",
"1.0.0b1",
"1.0.0b2",
"1.0.0rc1",
"1.0.0rc2",
"1.0.0rc3",
"1.0.1",
"1.0.1rc1",
"1.0.2",
"1.0.2rc1",
"1.0.3",
"1.0.4",
"1.0.5",
"1.0.5rc1",
"1.0.5rc2",
"1.0.5rc3",
"1.0.6",
"1.0.6rc1",
"1.0.7",
"1.0.8",
"1.0.9",
"1.1.0",
"1.1.0b1",
"1.1.0rc1",
"1.1.0rc2",
"1.1.0rc3",
"1.1.1",
"1.1.1rc1",
"1.1.1rc2",
"1.1.2",
"1.1.2rc1",
"1.1.3",
"1.1.4",
"1.1.5",
"1.2.0",
"1.2.0b1",
"1.2.0rc1",
"1.2.0rc2",
"1.2.1",
"1.2.1rc1",
"1.2.1rc2",
"1.2.2",
"1.2.3",
"1.2.4",
"1.2.5",
"1.2.6",
"1.3.0",
"1.3.0b1",
"1.3.0b2",
"1.3.0rc1",
"1.3.0rc2",
"1.3.1",
"1.3.2",
"1.3.2rc1",
"1.3.3",
"1.3.4",
"1.3.5",
"1.3.6",
"1.3.7",
"1.4.0",
"1.4.0b1",
"1.4.0rc1",
"1.4.0rc2",
"1.4.1",
"1.4.2",
"1.4.2rc1",
"1.4.2rc2",
"1.4.3",
"1.4.4",
"1.4.5",
"1.4.6",
"1.4.7",
"1.4.8",
"1.4.9",
"1.5.0",
"1.5.0b1",
"1.5.0b2",
"1.5.0b3",
"1.5.0b4",
"1.5.0b5",
"1.5.0rc1",
"1.5.0rc2",
"1.5.1",
"1.5.10",
"1.5.11",
"1.5.1rc1",
"1.5.1rc2",
"1.5.2",
"1.5.2rc1",
"1.5.2rc2",
"1.5.3",
"1.5.4",
"1.5.4rc1",
"1.5.5",
"1.5.6",
"1.5.7",
"1.5.8",
"1.5.9",
"1.6.0",
"1.6.0b1",
"1.6.0b2",
"1.6.0b3",
"1.6.0b4",
"1.6.0b5",
"1.6.0b6",
"1.6.0b7",
"1.6.0b8",
"1.6.0rc1",
"1.6.0rc2",
"1.6.1",
"1.6.10",
"1.6.11",
"1.6.12",
"1.6.13",
"1.6.1rc1",
"1.6.2",
"1.6.3",
"1.6.4",
"1.6.5",
"1.6.6",
"1.6.7",
"1.6.8",
"1.6.9",
"1.7.0",
"1.7.1",
"1.7.10",
"1.7.11",
"1.7.12",
"1.7.13",
"1.7.2",
"1.7.3",
"1.7.4",
"1.7.5",
"1.7.6",
"1.7.7",
"1.7.8",
"1.7.9"
]
}
],
"aliases": [
"CVE-2024-40637",
"GHSA-p3f3-5ccg-83xq"
],
"details": "dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. When a user installs a package in dbt, it has the ability to override macros, materializations, and other core components of dbt. This is by design, as it allows packages to extend and customize dbt\u0027s functionality. However, this also means that a malicious package could potentially override these components with harmful code. This issue has been fixed in versions 1.8.0, 1.6.14 and 1.7.14. Users are advised to upgrade. There are no kn own workarounds for this vulnerability. Users updating to either 1.6.14 or 1.7.14 will need to set `flags.require_explicit_package_overrides_for_builtin_materializations: False` in their configuration in `dbt_project.yml`.",
"id": "PYSEC-2024-66",
"modified": "2024-07-19T17:21:49.664320+00:00",
"published": "2024-07-16T23:15:00+00:00",
"references": [
{
"type": "ADVISORY",
"url": "https://github.com/dbt-labs/dbt-core/security/advisories/GHSA-p3f3-5ccg-83xq"
},
{
"type": "FIX",
"url": "https://github.com/dbt-labs/dbt-core/commit/3c82a0296d227cb1be295356df314c11716f4ff6"
},
{
"type": "FIX",
"url": "https://github.com/dbt-labs/dbt-core/commit/87ac4deb00cc9fe334706e42a365903a1d581624"
},
{
"type": "WEB",
"url": "https://docs.getdbt.com/docs/build/packages"
},
{
"type": "ADVISORY",
"url": "https://docs.getdbt.com/reference/global-configs/legacy-behaviors#behavior-change-flags"
},
{
"type": "EVIDENCE",
"url": "https://tempered.works/posts/2024/07/06/preventing-data-theft-with-gcp-service-controls"
},
{
"type": "WEB",
"url": "https://tempered.works/posts/2024/07/06/preventing-data-theft-with-gcp-service-controls"
},
{
"type": "EVIDENCE",
"url": "https://www.elementary-data.com/post/are-dbt-packages-secure-the-answer-lies-in-your-dwh-policies"
},
{
"type": "WEB",
"url": "https://www.elementary-data.com/post/are-dbt-packages-secure-the-answer-lies-in-your-dwh-policies"
},
{
"type": "EVIDENCE",
"url": "https://www.equalexperts.com/blog/tech-focus/are-you-at-risk-from-this-critical-dbt-vulnerability"
},
{
"type": "ARTICLE",
"url": "https://www.equalexperts.com/blog/tech-focus/are-you-at-risk-from-this-critical-dbt-vulnerability"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…