pysec-2024-66
Vulnerability from pysec
Published
2024-07-16 23:15
Modified
2024-07-19 17:21
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. When a user installs a package in dbt, it has the ability to override macros, materializations, and other core components of dbt. This is by design, as it allows packages to extend and customize dbt's functionality. However, this also means that a malicious package could potentially override these components with harmful code. This issue has been fixed in versions 1.8.0, 1.6.14 and 1.7.14. Users are advised to upgrade. There are no kn own workarounds for this vulnerability. Users updating to either 1.6.14 or 1.7.14 will need to set flags.require_explicit_package_overrides_for_builtin_materializations: False in their configuration in dbt_project.yml.

Aliases


To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "dbt-core",
        "purl": "pkg:pypi/dbt-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3c82a0296d227cb1be295356df314c11716f4ff6"
            },
            {
              "fixed": "87ac4deb00cc9fe334706e42a365903a1d581624"
            }
          ],
          "repo": "https://github.com/dbt-labs/dbt-core",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "1.7.0"
            },
            {
              "fixed": "1.7.14"
            },
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.13.0",
        "0.13.0a1",
        "0.13.0a2",
        "0.13.0rc1",
        "0.13.1",
        "0.13.1a1",
        "0.13.1a2",
        "0.14.0",
        "0.14.0a1",
        "0.14.0a2",
        "0.14.0rc1",
        "0.14.1",
        "0.14.1a1",
        "0.14.1rc1",
        "0.14.1rc2",
        "0.14.2",
        "0.14.3",
        "0.14.3rc1",
        "0.14.4",
        "0.15.0",
        "0.15.0b1",
        "0.15.0b2",
        "0.15.0b3",
        "0.15.0rc1",
        "0.15.0rc2",
        "0.15.1",
        "0.15.1rc1",
        "0.15.1rc2",
        "0.15.2",
        "0.15.3",
        "0.15.3rc1",
        "0.16.0",
        "0.16.0b1",
        "0.16.0b2",
        "0.16.0b3",
        "0.16.0rc1",
        "0.16.0rc2",
        "0.16.0rc3",
        "0.16.0rc4",
        "0.16.1",
        "0.16.1rc1",
        "0.17.0",
        "0.17.0b1",
        "0.17.0b2",
        "0.17.0rc1",
        "0.17.0rc2",
        "0.17.0rc3",
        "0.17.0rc4",
        "0.17.1",
        "0.17.1rc1",
        "0.17.1rc2",
        "0.17.1rc3",
        "0.17.1rc4",
        "0.17.2",
        "0.17.2b1",
        "0.17.2rc1",
        "0.18.0",
        "0.18.0b1",
        "0.18.0b2",
        "0.18.0rc1",
        "0.18.0rc2",
        "0.18.1",
        "0.18.1b1",
        "0.18.1b2",
        "0.18.1b3",
        "0.18.1rc1",
        "0.18.2",
        "0.18.2rc1",
        "0.19.0",
        "0.19.0b1",
        "0.19.0rc1",
        "0.19.0rc2",
        "0.19.0rc3",
        "0.19.1",
        "0.19.1b2",
        "0.19.1rc1",
        "0.19.1rc2",
        "0.19.2",
        "0.19.2rc1",
        "0.19.2rc2",
        "0.20.0",
        "0.20.0b1",
        "0.20.0rc1",
        "0.20.0rc2",
        "0.20.1",
        "0.20.1rc1",
        "0.20.2",
        "0.20.2rc1",
        "0.20.2rc2",
        "0.21.0",
        "0.21.0b1",
        "0.21.0b2",
        "0.21.0rc1",
        "0.21.0rc2",
        "0.21.1",
        "0.21.1rc1",
        "0.21.1rc2",
        "1.0.0",
        "1.0.0b1",
        "1.0.0b2",
        "1.0.0rc1",
        "1.0.0rc2",
        "1.0.0rc3",
        "1.0.1",
        "1.0.1rc1",
        "1.0.2",
        "1.0.2rc1",
        "1.0.3",
        "1.0.4",
        "1.0.5",
        "1.0.5rc1",
        "1.0.5rc2",
        "1.0.5rc3",
        "1.0.6",
        "1.0.6rc1",
        "1.0.7",
        "1.0.8",
        "1.0.9",
        "1.1.0",
        "1.1.0b1",
        "1.1.0rc1",
        "1.1.0rc2",
        "1.1.0rc3",
        "1.1.1",
        "1.1.1rc1",
        "1.1.1rc2",
        "1.1.2",
        "1.1.2rc1",
        "1.1.3",
        "1.1.4",
        "1.1.5",
        "1.2.0",
        "1.2.0b1",
        "1.2.0rc1",
        "1.2.0rc2",
        "1.2.1",
        "1.2.1rc1",
        "1.2.1rc2",
        "1.2.2",
        "1.2.3",
        "1.2.4",
        "1.2.5",
        "1.2.6",
        "1.3.0",
        "1.3.0b1",
        "1.3.0b2",
        "1.3.0rc1",
        "1.3.0rc2",
        "1.3.1",
        "1.3.2",
        "1.3.2rc1",
        "1.3.3",
        "1.3.4",
        "1.3.5",
        "1.3.6",
        "1.3.7",
        "1.4.0",
        "1.4.0b1",
        "1.4.0rc1",
        "1.4.0rc2",
        "1.4.1",
        "1.4.2",
        "1.4.2rc1",
        "1.4.2rc2",
        "1.4.3",
        "1.4.4",
        "1.4.5",
        "1.4.6",
        "1.4.7",
        "1.4.8",
        "1.4.9",
        "1.5.0",
        "1.5.0b1",
        "1.5.0b2",
        "1.5.0b3",
        "1.5.0b4",
        "1.5.0b5",
        "1.5.0rc1",
        "1.5.0rc2",
        "1.5.1",
        "1.5.10",
        "1.5.11",
        "1.5.1rc1",
        "1.5.1rc2",
        "1.5.2",
        "1.5.2rc1",
        "1.5.2rc2",
        "1.5.3",
        "1.5.4",
        "1.5.4rc1",
        "1.5.5",
        "1.5.6",
        "1.5.7",
        "1.5.8",
        "1.5.9",
        "1.6.0",
        "1.6.0b1",
        "1.6.0b2",
        "1.6.0b3",
        "1.6.0b4",
        "1.6.0b5",
        "1.6.0b6",
        "1.6.0b7",
        "1.6.0b8",
        "1.6.0rc1",
        "1.6.0rc2",
        "1.6.1",
        "1.6.10",
        "1.6.11",
        "1.6.12",
        "1.6.13",
        "1.6.1rc1",
        "1.6.2",
        "1.6.3",
        "1.6.4",
        "1.6.5",
        "1.6.6",
        "1.6.7",
        "1.6.8",
        "1.6.9",
        "1.7.0",
        "1.7.1",
        "1.7.10",
        "1.7.11",
        "1.7.12",
        "1.7.13",
        "1.7.2",
        "1.7.3",
        "1.7.4",
        "1.7.5",
        "1.7.6",
        "1.7.7",
        "1.7.8",
        "1.7.9"
      ]
    }
  ],
  "aliases": [
    "CVE-2024-40637",
    "GHSA-p3f3-5ccg-83xq"
  ],
  "details": "dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. When a user installs a package in dbt, it has the ability to override macros, materializations, and other core components of dbt. This is by design, as it allows packages to extend and customize dbt\u0027s functionality. However, this also means that a malicious package could potentially override these components with harmful code. This issue has been fixed in versions 1.8.0, 1.6.14 and 1.7.14. Users are advised to upgrade. There are no kn own workarounds for this vulnerability. Users updating to either 1.6.14 or 1.7.14 will need to set `flags.require_explicit_package_overrides_for_builtin_materializations: False` in their configuration in `dbt_project.yml`.",
  "id": "PYSEC-2024-66",
  "modified": "2024-07-19T17:21:49.664320+00:00",
  "published": "2024-07-16T23:15:00+00:00",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/dbt-labs/dbt-core/security/advisories/GHSA-p3f3-5ccg-83xq"
    },
    {
      "type": "FIX",
      "url": "https://github.com/dbt-labs/dbt-core/commit/3c82a0296d227cb1be295356df314c11716f4ff6"
    },
    {
      "type": "FIX",
      "url": "https://github.com/dbt-labs/dbt-core/commit/87ac4deb00cc9fe334706e42a365903a1d581624"
    },
    {
      "type": "WEB",
      "url": "https://docs.getdbt.com/docs/build/packages"
    },
    {
      "type": "ADVISORY",
      "url": "https://docs.getdbt.com/reference/global-configs/legacy-behaviors#behavior-change-flags"
    },
    {
      "type": "EVIDENCE",
      "url": "https://tempered.works/posts/2024/07/06/preventing-data-theft-with-gcp-service-controls"
    },
    {
      "type": "WEB",
      "url": "https://tempered.works/posts/2024/07/06/preventing-data-theft-with-gcp-service-controls"
    },
    {
      "type": "EVIDENCE",
      "url": "https://www.elementary-data.com/post/are-dbt-packages-secure-the-answer-lies-in-your-dwh-policies"
    },
    {
      "type": "WEB",
      "url": "https://www.elementary-data.com/post/are-dbt-packages-secure-the-answer-lies-in-your-dwh-policies"
    },
    {
      "type": "EVIDENCE",
      "url": "https://www.equalexperts.com/blog/tech-focus/are-you-at-risk-from-this-critical-dbt-vulnerability"
    },
    {
      "type": "ARTICLE",
      "url": "https://www.equalexperts.com/blog/tech-focus/are-you-at-risk-from-this-critical-dbt-vulnerability"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.