dbt-coves (0.21.0a17) potentially affected by CVE-2023-36830 via sqlfluff (0.9.3)

sqlfluff PYPI version 0.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - dbt-coves 0.21.0a17 Source cves: CVE-2023-36830 Source advisory: OSV:PYSEC-2023-111...

dbt-coves (>=0.21.0a18, <=0.21.1a20) potentially affected by CVE-2023-36830 via sqlfluff (0.9.4)

sqlfluff PYPI version 0.9.4 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - dbt-coves =0.21.0a18, =0.21.1a20 Source cves: CVE-2023-36830 Source advisory: OSV:PYSEC-2023-111...

dbt-coves (>=1.0.4a27, <=1.1.1a0) potentially affected by CVE-2023-36830 via sqlfluff (0.11.2)

sqlfluff PYPI version 0.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - dbt-coves =1.0.4a27, =1.1.1a0 Source cves: CVE-2023-36830 Source advisory: OSV:PYSEC-2023-111...

alvin-cli (0.0.1a0) potentially affected by CVE-2023-36830 via sqlfluff (0.12.0)

sqlfluff PYPI version 0.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - alvin-cli 0.0.1a0 Source cves: CVE-2023-36830 Source advisory: OSV:PYSEC-2023-111...

PYSEC-2023-111

SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. For many users wh...

UBUNTU-CVE-2023-36830

SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. For many users wh...

PYSEC-2023-111

SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. For many users wh...

CVE-2023-36830

CVE-2023-36830 affects SQLFluff prior to v2.1.2 where an attacker with access to config files could abuse the library_path setting to execute arbitrary Python code via Jinja/macros. The issue arises when untrusted users can view or modify config and leverage library_path to reach Python execution...

CVE-2023-36830

SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. For many users wh...

CVE-2023-36830 SQLFluff vulnerability for users with access to config file, using `library_path` to call arbitrary python code.

SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. For many users wh...

CVE-2023-36830 SQLFluff vulnerability for users with access to config file, using `library_path` to call arbitrary python code.

SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. For many users wh...

CVE-2023-36830

SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. For many users wh...

alvin-cli (>=0.0.1a0, <=1.2.0), cumulus-library (>=0.1.2, <=1.4.0) +15 more potentially affected by CVE-2023-36830 via sqlfluff (>=0.6.9, <=2.1.1)

sqlfluff PYPI version =0.6.9, =0.0.1a0, =0.1.2, =0.1.2, =0.19.1a7, =0.9.3, =0.1.0, =0.1.0, =0.1.5, =0.1.0, =0.3.0a0, =0.13.2.6, =1.0.2, =0.8.0, =0.0.0, =1.2.1, =2.1.1 and more Source cves: CVE-2023-36830 Source advisory: MEND:CVE-2023-36830...

CVE-2023-36830 SQLFluff vulnerability for users with access to config file, using `library_path` to call arbitrary python code.

SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. For many users wh...

SQLFluff injection vulnerability

SQLFluff is a dialect-flexible and configurable SQL linter. An injection vulnerability exists in SQLFluff versions prior to 2.1.2 that stems from allowing an attacker to call arbitrary python code via libarypath...

CVE-2023-36830: Improper Neutralization of Special Elements in Output Used by a Downstream Component

SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. For many users wh...

CVE-2023-36830

SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. For many users wh...