dbt (0.18.2rc1), dbt-bigquery (0.18.2rc1) +2 more potentially affected by CVE-2024-36105 via dbt-core (0.18.2rc1)

dbt-core PYPI version 0.18.2rc1 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.18.2rc1 - dbt-bigquery 0.18.2rc1 - dbt-postgres 0.18.2rc1 - dbt-redshift 0.18.2rc1 Source cves: CVE-2024-36105 Source advisory:...

airflow-dbt-python (>=0.14.0, <=0.14.3), alvin-cli (>=0.0.1a0, <=1.3.0) +92 more potentially affected by CVE-2024-36105 via dbt-core (>=1.0.0b1, <=1.6.14)

dbt-core PYPI version =1.0.0b1, =0.14.0, =0.0.1a0, =0.15.3, =0.0.1a1, =1.3.0, =1.1.7, =1.0.0b1, =1.0.0, =0.1.0, =1.0.4a27, =1.5.2, =0.0.1, =1.4.2 and more Source cves: CVE-2024-36105 Source advisory: OSV:GHSA-PMRX-695R-4349...

dbt (0.20.0b1), dbt-bigquery (0.20.0b1) +3 more potentially affected by CVE-2024-36105 via dbt-core (0.20.0b1)

dbt-core PYPI version 0.20.0b1 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.20.0b1 - dbt-bigquery 0.20.0b1 - dbt-postgres 0.20.0b1 - dbt-redshift 0.20.0b1 - dbt-snowflake 0.20.0b1 Source cves: CVE-2024-36105...

CVE-2024-36105

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. Prior to versions 1.6.15, 1.7.15, and 1.8.1, Binding to INADDRANY 0.0.0.0 or IN6ADDRANY :: exposes an application on all network interfaces, increasing the...

CVE-2024-36105 dbt allows Binding to an Unrestricted IP Address via socketsocket

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. Prior to versions 1.6.15, 1.7.15, and 1.8.1, Binding to INADDRANY 0.0.0.0 or IN6ADDRANY :: exposes an application on all network interfaces, increasing the...

CVE-2024-36105

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. Prior to versions 1.6.15, 1.7.15, and 1.8.1, Binding to "INADDRANY 0.0.0.0" or "IN6ADDRANY ::" exposes an application on all network interfaces, increasing t...

CVE-2024-36105

CVE-2024-36105 affects dbt-core prior to 1.6.15, 1.7.15, and 1.8.1. The issue arises when the docs server binds to INADDR_ANY or IN6ADDR_ANY (0.0.0.0/::) instead of localhost, exposing the HTTP server on all network interfaces. This can enable unauthorized access from other hosts on the same netw...

data-pipelines-cli (0.31.0), dbt-dremio (1.7.0) +12 more potentially affected by CVE-2024-36105 via dbt-core (>=1.7.0, <=1.7.14)

dbt-core PYPI version =1.7.0, =1.7.0, =0.0.2, =0.5.0, =1.7.0, =1.7.0, =0.0.4, =0.4.3, =0.1.0, =0.0.1rc8, =0.2.1, =0.1.0, =0.2.1 Source cves: CVE-2024-36105 Source advisory: MEND:CVE-2024-36105...

dbt-docs-mcp (0.0.1), dbt-fabric (1.8.4) +1 more potentially affected by CVE-2024-36105 via dbt-core (1.8.0)

dbt-core PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt-docs-mcp 0.0.1 - dbt-fabric 1.8.4 - dbt-loom =0.5.3, =0.5.4 Source cves: CVE-2024-36105 Source advisory: MEND:CVE-2024-36105...

CVE-2024-36105 dbt allows Binding to an Unrestricted IP Address via socketsocket

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. Prior to versions 1.6.15, 1.7.15, and 1.8.1, Binding to INADDRANY 0.0.0.0 or IN6ADDRANY :: exposes an application on all network interfaces, increasing the...

CVE-2024-36105 dbt allows Binding to an Unrestricted IP Address via socketsocket

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. Prior to versions 1.6.15, 1.7.15, and 1.8.1, Binding to INADDRANY 0.0.0.0 or IN6ADDRANY :: exposes an application on all network interfaces, increasing the...

airflow-dbt-python (>=0.2.0, <=0.14.3), alvin-cli (>=0.0.1a0, <=1.3.0) +101 more potentially affected by CVE-2024-36105 via dbt-core (>=0.14.0, <=1.6.14)

dbt-core PYPI version =0.14.0, =0.2.0, =0.0.1a0, =0.15.3, =0.0.1a1, =0.15.3rc1, =1.3.0, =1.1.7, =0.15.3rc1, =0.18.2, =0.1.0, =0.19.1a7, =1.5.11 and more Source cves: CVE-2024-36105 Source advisory: MEND:CVE-2024-36105...

CVE-2024-36105: Binding to an Unrestricted IP Address

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. Prior to versions 1.6.15, 1.7.15, and 1.8.1, Binding to INADDRANY 0.0.0.0 or IN6ADDRANY :: exposes an application on all network interfaces, increasing the...

PT-2024-26893

Name of the Vulnerable Software and Affected Versions dbt-core versions prior to 1.6.15 dbt-core versions prior to 1.7.15 dbt-core versions prior to 1.8.1 Description The issue arises from binding to INADDR ANY 0.0.0.0 or IN6ADDR ANY ::, which exposes the application on all network interfaces,...

dbt security vulnerabilities

dbt is a data transcription tool. A security vulnerability exists in dbt that stems from the ability to bind to unrestricted IP addresses via socket ketsocket, which increases the risk of unauthorized access...

aaz-dev (>=1.0.2, <=2.10.1), adminui (1.5.2) +190 more potentially affected by CVE-2024-34069 via werkzeug (2.1.2)

werkzeug PYPI version 2.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - aaz-dev =1.0.2, =1.5.2, =0.14.0, =0.0.1a0, =1.5.0, =1.1.1, =2.6.0, =1.0.5, =1.7.1, =1.3.0, =3.1.0, =1.45.0, =1.47.0 and more Source cves:...

dbt uses a SQLparse version with a high vulnerability

Summary Using a version of sqlparse that has a security vulnerability and no way to update in current version of dbt core. Snyk recommends using sqlparse==0.5 but this causes a conflict with dbt. Snyk states the issues is a recursion error: SNYK-PYTHON-SQLPARSE-6615674. Details Dependency conflic...

GHSA-P72Q-H37J-3HQ7 dbt uses a SQLparse version with a high vulnerability

Summary Using a version of sqlparse that has a security vulnerability and no way to update in current version of dbt core. Snyk recommends using sqlparse==0.5 but this causes a conflict with dbt. Snyk states the issues is a recursion error: SNYK-PYTHON-SQLPARSE-6615674. Details Dependency conflic...

dbt-loom (>=0.1.2, <=0.3.1), dbt-postgres (>=1.6.0, <=1.6.12) +5 more potentially affected by unknown CVE via dbt-core (>=1.6.0, <=1.6.12)

dbt-core PYPI version =1.6.0, =0.1.2, =1.6.0, =1.3.0, =1.6.0, =1.6.0, =0.0.1, =0.0.11 Source cves: unknown CVE Source advisory: GHSA-P72Q-H37J-3HQ7...

data-pipelines-cli (0.31.0), dbt-postgres (>=1.7.0, <=1.7.12) +11 more potentially affected by unknown CVE via dbt-core (>=1.7.0, <=1.7.12)

dbt-core PYPI version =1.7.0, =1.7.0, =0.0.2, =0.5.0, =1.7.0, =1.7.0, =0.0.4, =0.4.3, =0.1.0, =0.0.1rc8, =0.2.1, =0.1.0, =0.2.1 Source cves: unknown CVE Source advisory: OSV:GHSA-P72Q-H37J-3HQ7...