CVE-2024-40637

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. When a user installs a package in dbt, it has the ability to override macros, materializations, and other core components of dbt. This is by design, as it...

dbt-loom (>=0.1.2, <=0.3.1), dbt-postgres (>=1.6.0, <=1.6.13) +5 more potentially affected by CVE-2024-40637 via dbt-core (>=1.6.0, <=1.6.13)

dbt-core PYPI version =1.6.0, =0.1.2, =1.6.0, =1.3.0, =1.6.0, =1.6.0, =0.0.1, =0.0.11 Source cves: CVE-2024-40637 Source advisory: MEND:CVE-2024-40637...

data-pipelines-cli (0.31.0), dbt-dremio (1.7.0) +12 more potentially affected by CVE-2024-40637 via dbt-core (>=1.7.0, <=1.7.13)

dbt-core PYPI version =1.7.0, =1.7.0, =0.0.2, =0.5.0, =1.7.0, =1.7.0, =0.0.4, =0.4.3, =0.1.0, =0.0.1rc8, =0.2.1, =0.1.0, =0.2.1 Source cves: CVE-2024-40637 Source advisory: MEND:CVE-2024-40637...

CVE-2024-40637: Improper Neutralization of Special Elements in Output Used by a Downstream Component

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. When a user installs a package in dbt, it has the ability to override macros, materializations, and other core components of dbt. This is by design, as it...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview dbt-core is a With dbt, data analysts and engineers can build analytics the way engineers build applications. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' allowing an attacker to insta...

data-pipelines-cli (0.31.0), dbt-dremio (1.7.0) +12 more potentially affected by CVE-2024-40637 via dbt-core (>=1.7.0, <=1.7.13)

dbt-core PYPI version =1.7.0, =1.7.0, =0.0.2, =0.5.0, =1.7.0, =1.7.0, =0.0.4, =0.4.3, =0.1.0, =0.0.1rc8, =0.2.1, =0.1.0, =0.2.1 Source cves: CVE-2024-40637 Source advisory: SNYK:PYTHON-DBTCORE-7430282...

airflow-dbt-python (>=0.2.0, <=0.14.3), alvin-cli (>=0.0.1a0, <=1.3.0) +101 more potentially affected by CVE-2024-40637 via dbt-core (>=0.14.0, <=1.6.13)

dbt-core PYPI version =0.14.0, =0.2.0, =0.0.1a0, =0.15.3, =0.0.1a1, =0.15.3rc1, =1.3.0, =1.1.7, =0.15.3rc1, =0.18.2, =0.1.0, =0.19.1a7, =1.5.11 and more Source cves: CVE-2024-40637 Source advisory: SNYK:PYTHON-DBTCORE-7430282...

Malicious code in data-platform-dbt (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Binding To An Unrestricted IP Address

dbt-core is vulnerable to Binding to an Unrestricted IP Address. The vulnerability is due to the binding of INADDRANY or IN6ADDRANY to any network interface on the local system not just localhost, which exposes the application on all network interfaces. An attacker can gain unauthorized access by...

dbt (0.21.0b1), dbt-bigquery (0.21.0b1) +5 more potentially affected by CVE-2024-36105 via dbt-core (0.21.0b1)

dbt-core PYPI version 0.21.0b1 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.21.0b1 - dbt-bigquery 0.21.0b1 - dbt-postgres 0.21.0b1 - dbt-presto 0.21.0b1 - dbt-redshift 0.21.0b1 - dbt-snowflake 0.21.0b1 - dbt-spa...

dbt-presto (0.14.0) potentially affected by CVE-2024-36105 via dbt-core (0.14.0)

dbt-core PYPI version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt-presto 0.14.0 Source cves: CVE-2024-36105 Source advisory: OSV:GHSA-PMRX-695R-4349...

dbt (0.16.0rc2), dbt-bigquery (0.16.0rc2) +3 more potentially affected by CVE-2024-36105 via dbt-core (0.16.0rc2)

dbt-core PYPI version 0.16.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.16.0rc2 - dbt-bigquery 0.16.0rc2 - dbt-postgres 0.16.0rc2 - dbt-redshift 0.16.0rc2 - dbt-snowflake 0.16.0rc2 Source cves: CVE-2024-361...

dbt (0.15.3), dbt-bigquery (0.15.3) +5 more potentially affected by CVE-2024-36105 via dbt-core (0.15.3)

dbt-core PYPI version 0.15.3 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.15.3 - dbt-bigquery 0.15.3 - dbt-postgres 0.15.3 - dbt-presto 0.15.3 - dbt-redshift 0.15.3 - dbt-snowflake 0.15.3 - dbt-sqlserver 0.15.3....

dbt (0.17.0b1), dbt-bigquery (0.17.0b1) +3 more potentially affected by CVE-2024-36105 via dbt-core (0.17.0b1)

dbt-core PYPI version 0.17.0b1 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.17.0b1 - dbt-bigquery 0.17.0b1 - dbt-postgres 0.17.0b1 - dbt-redshift 0.17.0b1 - dbt-snowflake 0.17.0b1 Source cves: CVE-2024-36105...

dbt (0.16.0b3), dbt-bigquery (0.16.0b3) +3 more potentially affected by CVE-2024-36105 via dbt-core (0.16.0b3)

dbt-core PYPI version 0.16.0b3 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.16.0b3 - dbt-bigquery 0.16.0b3 - dbt-postgres 0.16.0b3 - dbt-redshift 0.16.0b3 - dbt-snowflake 0.16.0b3 Source cves: CVE-2024-36105...

dbt (0.17.1rc3), dbt-bigquery (0.17.1rc3) +3 more potentially affected by CVE-2024-36105 via dbt-core (0.17.1rc3)

dbt-core PYPI version 0.17.1rc3 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.17.1rc3 - dbt-bigquery 0.17.1rc3 - dbt-postgres 0.17.1rc3 - dbt-redshift 0.17.1rc3 - dbt-snowflake 0.17.1rc3 Source cves: CVE-2024-361...

dbt-spark (0.14.3) potentially affected by CVE-2024-36105 via dbt-core (0.14.3)

dbt-core PYPI version 0.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt-spark 0.14.3 Source cves: CVE-2024-36105 Source advisory: OSV:GHSA-PMRX-695R-4349...

dbt (0.17.2rc1), dbt-bigquery (0.17.2rc1) +3 more potentially affected by CVE-2024-36105 via dbt-core (0.17.2rc1)

dbt-core PYPI version 0.17.2rc1 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.17.2rc1 - dbt-bigquery 0.17.2rc1 - dbt-postgres 0.17.2rc1 - dbt-redshift 0.17.2rc1 - dbt-snowflake 0.17.2rc1 Source cves: CVE-2024-361...

dbt (0.18.2rc1), dbt-bigquery (0.18.2rc1) +2 more potentially affected by CVE-2024-36105 via dbt-core (0.18.2rc1)

dbt-core PYPI version 0.18.2rc1 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.18.2rc1 - dbt-bigquery 0.18.2rc1 - dbt-postgres 0.18.2rc1 - dbt-redshift 0.18.2rc1 Source cves: CVE-2024-36105 Source advisory:...

dbt (0.18.0rc1), dbt-bigquery (0.18.0rc1) +3 more potentially affected by CVE-2024-36105 via dbt-core (0.18.0rc1)

dbt-core PYPI version 0.18.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.18.0rc1 - dbt-bigquery 0.18.0rc1 - dbt-postgres 0.18.0rc1 - dbt-redshift 0.18.0rc1 - dbt-synapse 0.18.0rc1 Source cves: CVE-2024-36105...