alvin-cli (>=0.0.1a0 <=1.2.0rc18), cumulus-library (>=0.1.2 <=1.4.0) +15 more potentially affected by CVE-2023-36830 via sqlfluff (>=0.11.2 <=2.1.1)

sqlfluff PYPI version =0.11.2, =0.0.1a0, =0.1.2, =0.1.2, =0.19.1a7, =0.9.3, =0.1.0, =0.1.0, =0.1.5, =0.1.0, =0.3.0a0, =0.13.2.6, =1.0.2, =0.8.0, =0.0.0, =1.2.1, =2.1.1 and more Source cves: CVE-2023-36830 Source advisory: OSV:GHSA-JQHC-M2J3-FJRX...

SQLFluff users with access to config file, using `libary_path` may call arbitrary python code

Impact In environments where untrusted users have access to the config files e.g. .sqlfluff, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. Jinja macros are executed within a sandboxed...

DEBIAN-CVE-2023-36830

SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. For many users wh...

CVE-2023-36830

SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. For many users wh...

PYSEC-2023-111

SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. For many users wh...

PYSEC-2023-111

SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. For many users wh...

Design/Logic Flaw

SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. For many users wh...

alvin-cli (>=0.0.1a0 <=1.2.0rc18), cumulus-library (>=0.1.2 <=1.4.0) +15 more potentially affected by CVE-2023-36830 via sqlfluff (>=0.11.2 <=2.1.1)

sqlfluff PYPI version =0.11.2, =0.0.1a0, =0.1.2, =0.1.2, =0.19.1a7, =0.9.3, =0.1.0, =0.1.0, =0.1.5, =0.1.0, =0.3.0a0, =0.13.2.6, =1.0.2, =0.8.0, =0.0.0, =1.2.1, =2.1.1 and more Source cves: CVE-2023-36830 Source advisory: OSV:PYSEC-2023-111...

UBUNTU-CVE-2023-36830

SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. For many users wh...

CVE-2023-36830 SQLFluff vulnerability for users with access to config file, using `library_path` to call arbitrary python code.

SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. For many users wh...

CVE-2023-36830

CVE-2023-36830 affects SQLFluff prior to v2.1.2 where an attacker with access to config files could abuse the library_path setting to execute arbitrary Python code via Jinja/macros. The issue arises when untrusted users can view or modify config and leverage library_path to reach Python execution...

CVE-2023-36830 SQLFluff vulnerability for users with access to config file, using `library_path` to call arbitrary python code.

SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. For many users wh...

CVE-2023-36830

SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. For many users wh...

CVE-2023-36830 SQLFluff vulnerability for users with access to config file, using `library_path` to call arbitrary python code.

SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. For many users wh...

SQLFluff 注入漏洞

SQLFluff is a dialect-flexible and configurable SQL linter. An injection vulnerability exists in SQLFluff versions prior to 2.1.2 that stems from allowing an attacker to call arbitrary python code via libarypath...

CVE-2023-36830

SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. For many users wh...