dbt-loom (>=0.1.2, <=0.3.1), dbt-postgres (>=1.6.0, <=1.6.12) +5 more potentially affected by unknown CVE via dbt-core (>=1.6.0, <=1.6.12)

dbt-core PYPI version =1.6.0, =0.1.2, =1.6.0, =1.3.0, =1.6.0, =1.6.0, =0.0.1, =0.0.11 Source cves: unknown CVE Source advisory: OSV:GHSA-P72Q-H37J-3HQ7...

data-pipelines-cli (0.31.0), dbt-postgres (>=1.7.0, <=1.7.12) +11 more potentially affected by unknown CVE via dbt-core (>=1.7.0, <=1.7.12)

dbt-core PYPI version =1.7.0, =1.7.0, =0.0.2, =0.5.0, =1.7.0, =1.7.0, =0.0.4, =0.4.3, =0.1.0, =0.0.1rc8, =0.2.1, =0.1.0, =0.2.1 Source cves: unknown CVE Source advisory: GHSA-P72Q-H37J-3HQ7...

PT-2024-40393 · Dbt-Core +1 · Dbt-Core +1

Name of the Vulnerable Software and Affected Versions: dbt-core versions 1.6.0 through 1.6.12 dbt-core versions 1.7.0 through 1.7.12 Description: The issue is related to a recursion error in the sqlparse library used by dbt-core. This error can be triggered by parsing a specific SQL query, such a...

acryl-datahub-gx-plugin (>=0.14.0.3rc1, <=0.15.0rc15), agnostic (1.0.3) +465 more potentially affected by CVE-2024-4340 via sqlparse (>=0.1.14, <=0.4.4)

sqlparse PYPI version =0.1.14, =0.14.0.3rc1, =0.2.0, =0.0.1, =0.1.0, =2.0.0, =0.8.0, =0.0.1a0, =0.1.0, =2.1.1.3, =1.0.0, =0.1.1, =0.7.11, =0.7.36 and more Source cves: CVE-2024-4340 Source advisory: OSV:GHSA-2M57-HF25-PHGG...

acryl-datahub-airflow-plugin (>=0.8.44.4rc1, <=0.9.2.1), airflow-add-ons (0.2.9b2) +16 more potentially affected by CVE-2024-25128 via flask-appbuilder (3.4.5)

flask-appbuilder PYPI version 3.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - acryl-datahub-airflow-plugin =0.8.44.4rc1, =0.6.0, =0.2.0, =0.0.3, =0.0.6, =0.0.1, =2.0.2rc1, =0.0.4rc1, =0.0.0, =0.5.2, =0.8.3a...

dbt-postgres (>=1.7.0, <=1.7.2), dbt-tests-adapter (>=1.7.0, <=1.7.2) +3 more potentially affected by unknown CVE via dbt-core (>=1.7.0, <=1.7.2)

dbt-core PYPI version =1.7.0, =1.7.0, =1.7.0, =0.0.4, =0.2.1, =0.1.0, =0.2.1 Source cves: unknown CVE Source advisory: GHSA-J4G3-3Q8X-JXQP...

dbt-postgres (>=1.7.0, <=1.7.2), dbt-tests-adapter (>=1.7.0, <=1.7.2) +3 more potentially affected by unknown CVE via dbt-core (>=1.7.0, <=1.7.2)

dbt-core PYPI version =1.7.0, =1.7.0, =1.7.0, =0.0.4, =0.2.1, =0.1.0, =0.2.1 Source cves: unknown CVE Source advisory: OSV:GHSA-J4G3-3Q8X-JXQP...

GHSA-J4G3-3Q8X-JXQP dbt-core's secret env vars written to package-lock.json in plaintext

Impact When used to pull source code from a private repository using a Personal Access Token PAT, some versions of dbt-core write a URL with the PAT in plaintext to the package-lock.yml file. Patches The bug has been fixed in dbt-core v1.7.3. Mitigations Remove any git URLs with plaintext secrets...

dbt-core's secret env vars written to package-lock.json in plaintext

Impact When used to pull source code from a private repository using a Personal Access Token PAT, some versions of dbt-core write a URL with the PAT in plaintext to the package-lock.yml file. Patches The bug has been fixed in dbt-core v1.7.3. Mitigations Remove any git URLs with plaintext secrets...

PT-2023-33033 · Dbt-Core · Dbt-Core

Name of the Vulnerable Software and Affected Versions: dbt-core versions prior to 1.7.3 Description: The issue arises when dbt-core is used to pull source code from a private repository using a Personal Access Token PAT. In this scenario, some versions of dbt-core write a URL with the PAT in...

dbt-coves (>=1.0.4a27, <=1.1.1a0) potentially affected by CVE-2023-36830 via sqlfluff (0.11.2)

sqlfluff PYPI version 0.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - dbt-coves =1.0.4a27, =1.1.1a0 Source cves: CVE-2023-36830 Source advisory: OSV:GHSA-JQHC-M2J3-FJRX...

sqlfluff-templater-dbt (1.4.4) potentially affected by CVE-2023-36830 via sqlfluff (1.4.4)

sqlfluff PYPI version 1.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - sqlfluff-templater-dbt 1.4.4 Source cves: CVE-2023-36830 Source advisory: OSV:GHSA-JQHC-M2J3-FJRX...

dbt-coves (>=0.19.1a7, <=0.21.0a1), jsqlib (>=0.3.0a0, <=0.8.0a0) potentially affected by CVE-2023-36830 via sqlfluff (0.6.9)

sqlfluff PYPI version 0.6.9 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - dbt-coves =0.19.1a7, =0.3.0a0, =0.8.0a0 Source cves: CVE-2023-36830 Source advisory: OSV:GHSA-JQHC-M2J3-FJRX...

dbt-osmosis (>=0.9.3, <=0.10.0), dbt-superset-lineage (>=0.3.0, <=0.3.2) +3 more potentially affected by CVE-2023-36830 via sqlfluff (1.4.5)

sqlfluff PYPI version 1.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - dbt-osmosis =0.9.3, =0.3.0, =0.8.0, =0.0.0, =0.0.1 - sqlfluff-templater-dbt 1.4.5 Source cves: CVE-2023-36830 Source advisory:...

alvin-cli (>=1.1.9, <=1.2.0), cumulus-library (>=0.1.2, <=1.4.0) +6 more potentially affected by CVE-2023-36830 via sqlfluff (>=2.0.0a1, <=2.1.1)

sqlfluff PYPI version =2.0.0a1, =1.1.9, =0.1.2, =0.1.2, =0.13.2.6, =1.0.2, =2.0.0a1, =1.4.2, =0.1.0, =0.1.1 Source cves: CVE-2023-36830 Source advisory: GHSA-JQHC-M2J3-FJRX...

dbt-superset-lineage (>=0.1.0, <=0.2.1), dwhgen (>=0.1.1, <=0.1.2) +1 more potentially affected by CVE-2023-36830 via sqlfluff (0.8.2)

sqlfluff PYPI version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - dbt-superset-lineage =0.1.0, =0.1.1, =0.1.5, =0.2.7 Source cves: CVE-2023-36830 Source advisory: OSV:GHSA-JQHC-M2J3-FJRX...

dbt-coves (>=0.21.0a18, <=0.21.1a20) potentially affected by CVE-2023-36830 via sqlfluff (0.9.4)

sqlfluff PYPI version 0.9.4 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - dbt-coves =0.21.0a18, =0.21.1a20 Source cves: CVE-2023-36830 Source advisory: OSV:GHSA-JQHC-M2J3-FJRX...

sqlfluff-templater-dbt (1.4.0) potentially affected by CVE-2023-36830 via sqlfluff (1.4.0)

sqlfluff PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - sqlfluff-templater-dbt 1.4.0 Source cves: CVE-2023-36830 Source advisory: OSV:GHSA-JQHC-M2J3-FJRX...

sqlfluff-templater-dbt (1.3.1) potentially affected by CVE-2023-36830 via sqlfluff (1.3.1)

sqlfluff PYPI version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - sqlfluff-templater-dbt 1.3.1 Source cves: CVE-2023-36830 Source advisory: OSV:GHSA-JQHC-M2J3-FJRX...

dbt-coves (>=0.21.0a2, <=0.21.0a16), dwhgen (0.1.0) +1 more potentially affected by CVE-2023-36830 via sqlfluff (0.7.1)

sqlfluff PYPI version 0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - dbt-coves =0.21.0a2, =0.1.0, =0.14.0 Source cves: CVE-2023-36830 Source advisory: OSV:GHSA-JQHC-M2J3-FJRX...