dbt (0.19.0rc3), dbt-bigquery (0.19.0rc3) +2 more potentially affected by CVE-2024-36105 via dbt-core (0.19.0rc3)

dbt-core PYPI version 0.19.0rc3 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.19.0rc3 - dbt-bigquery 0.19.0rc3 - dbt-postgres 0.19.0rc3 - dbt-redshift 0.19.0rc3 Source cves: CVE-2024-36105 Source advisory:...

dbt (0.19.1b2), dbt-bigquery (0.19.1b2) +4 more potentially affected by CVE-2024-36105 via dbt-core (0.19.1b2)

dbt-core PYPI version 0.19.1b2 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.19.1b2 - dbt-bigquery 0.19.1b2 - dbt-postgres 0.19.1b2 - dbt-presto 0.19.1b2 - dbt-redshift 0.19.1b2 - dbt-spark 0.19.1b2 Source cves:...

dbt (0.19.1rc2), dbt-bigquery (0.19.1rc2) +2 more potentially affected by CVE-2024-36105 via dbt-core (0.19.1rc2)

dbt-core PYPI version 0.19.1rc2 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.19.1rc2 - dbt-bigquery 0.19.1rc2 - dbt-postgres 0.19.1rc2 - dbt-redshift 0.19.1rc2 Source cves: CVE-2024-36105 Source advisory:...

dbt (0.19.2rc1), dbt-bigquery (0.19.2rc1) +2 more potentially affected by CVE-2024-36105 via dbt-core (0.19.2rc1)

dbt-core PYPI version 0.19.2rc1 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.19.2rc1 - dbt-bigquery 0.19.2rc1 - dbt-postgres 0.19.2rc1 - dbt-redshift 0.19.2rc1 Source cves: CVE-2024-36105 Source advisory:...

dbt (0.19.2rc2), dbt-bigquery (0.19.2rc2) +4 more potentially affected by CVE-2024-36105 via dbt-core (0.19.2rc2)

dbt-core PYPI version 0.19.2rc2 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.19.2rc2 - dbt-bigquery 0.19.2rc2 - dbt-postgres 0.19.2rc2 - dbt-presto 0.19.2rc2 - dbt-redshift 0.19.2rc2 - dbt-spark 0.19.2rc2 Source...

airflow-dbt-python (>=0.2.0, <=0.5.0), dbt (0.19.2) +14 more potentially affected by CVE-2024-36105 via dbt-core (0.19.2)

dbt-core PYPI version 0.19.2 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - airflow-dbt-python =0.2.0, =0.1.0, =0.4.0, =0.1.0, =0.19.0, =0.5.0, =0.5.2 and more Source cves: CVE-2024-36105 Source advisory:...

dbt (0.20.2rc1), dbt-bigquery (0.20.2rc1) +5 more potentially affected by CVE-2024-36105 via dbt-core (0.20.2rc1)

dbt-core PYPI version 0.20.2rc1 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.20.2rc1 - dbt-bigquery 0.20.2rc1 - dbt-postgres 0.20.2rc1 - dbt-presto 0.20.2rc1 - dbt-redshift 0.20.2rc1 - dbt-snowflake 0.20.2rc1 -...

dbt (0.20.2rc2), dbt-bigquery (0.20.2rc2) +5 more potentially affected by CVE-2024-36105 via dbt-core (0.20.2rc2)

dbt-core PYPI version 0.20.2rc2 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.20.2rc2 - dbt-bigquery 0.20.2rc2 - dbt-postgres 0.20.2rc2 - dbt-presto 0.20.2rc2 - dbt-redshift 0.20.2rc2 - dbt-snowflake 0.20.2rc2 -...

SQL Injection

com.amazon.redshift, redshift-jdbc42 is vulnerable to SQL Injection. The vulnerability is due to the use of a non-default connection property preferQueryMode=simple in combination with application code that has a vulnerable SQL statement which negates a parameter value. The vulnerability allows a...

SUSE CVE-2024-32888

The Amazon JDBC Driver for Redshift is a Type 4 JDBC driver that provides database connectivity through the standard JDBC application program interfaces APIs available in the Java Platform, Enterprise Editions. Prior to version 2.1.0.28, SQL injection is possible when using the non-default...

GHSA-X3WM-HFFR-CHWM Amazon JDBC Driver for Redshift SQL Injection via line comment generation

Impact SQL injection is possible when using the non-default connection property preferQueryMode=simple in combination with application code which has a vulnerable SQL that negates a parameter value. There is no vulnerability in the driver when using the default, extended query mode. Note that...

com.netflix.metacat:metacat-connector-redshift (>=1.3.0, <=1.3.1), com.trib3:db (>=1.19.1891, <=3.1.5004) +63 more potentially affected by CVE-2024-32888 via com.amazon.redshift:redshift-jdbc42 (>=2.0.0.3, <=2.1.0.26)

com.amazon.redshift:redshift-jdbc42 MAVEN version =2.0.0.3, =1.3.0, =1.19.1891, =0.1.15-alpha, =0.1.15-alpha, =0.1.15-alpha, =6.0.0-spark3.3, =0.2.8, =359, =1.0.0, =1.0.0, =2.3.4, =0.1.5, =0.1.1, =2.59.0, =3.0.0 and more Source cves: CVE-2024-32888 Source advisory: OSV:GHSA-X3WM-HFFR-CHWM...

com.netflix.metacat:metacat-connector-redshift (>=1.3.0, <=1.3.1), com.trib3:db (>=1.19.1891, <=3.1.5004) +63 more potentially affected by CVE-2024-32888 via com.amazon.redshift:redshift-jdbc42 (>=2.0.0.3, <=2.1.0.26)

com.amazon.redshift:redshift-jdbc42 MAVEN version =2.0.0.3, =1.3.0, =1.19.1891, =0.1.15-alpha, =0.1.15-alpha, =0.1.15-alpha, =6.0.0-spark3.3, =0.2.8, =359, =1.0.0, =1.0.0, =2.3.4, =0.1.5, =0.1.1, =2.59.0, =3.0.0 and more Source cves: CVE-2024-32888 Source advisory: GHSA-X3WM-HFFR-CHWM...

CVE-2024-32888

The Amazon JDBC Driver for Redshift is a Type 4 JDBC driver that provides database connectivity through the standard JDBC application program interfaces APIs available in the Java Platform, Enterprise Editions. Prior to version 2.1.0.28, SQL injection is possible when using the non-default...

CVE-2024-32888

The CVE-2024-32888 entry concerns the Amazon Redshift JDBC Driver (Type 4) with SQL injection possible before version 2.1.0.28 when using non-default connection property preferQueryMode=simple in conjunction with vulnerable SQL in application code that negates a parameter value. The vulnerability...

CVE-2024-32888 Amazon JDBC Driver for Redshift SQL Injection via line comment generation

The Amazon JDBC Driver for Redshift is a Type 4 JDBC driver that provides database connectivity through the standard JDBC application program interfaces APIs available in the Java Platform, Enterprise Editions. Prior to version 2.1.0.28, SQL injection is possible when using the non-default...

CVE-2024-32888 Amazon JDBC Driver for Redshift SQL Injection via line comment generation

The Amazon JDBC Driver for Redshift is a Type 4 JDBC driver that provides database connectivity through the standard JDBC application program interfaces APIs available in the Java Platform, Enterprise Editions. Prior to version 2.1.0.28, SQL injection is possible when using the non-default...

CVE-2024-32888 Amazon JDBC Driver for Redshift SQL Injection via line comment generation

The Amazon JDBC Driver for Redshift is a Type 4 JDBC driver that provides database connectivity through the standard JDBC application program interfaces APIs available in the Java Platform, Enterprise Editions. Prior to version 2.1.0.28, SQL injection is possible when using the non-default...

com.netflix.metacat:metacat-connector-redshift (>=1.3.0, <=1.3.1), com.trib3:db (>=1.19.1891, <=3.1.5004) +63 more potentially affected by CVE-2024-32888 via com.amazon.redshift:redshift-jdbc42 (>=2.0.0.3, <=2.1.0.26)

com.amazon.redshift:redshift-jdbc42 MAVEN version =2.0.0.3, =1.3.0, =1.19.1891, =0.1.15-alpha, =0.1.15-alpha, =0.1.15-alpha, =6.0.0-spark3.3, =0.2.8, =359, =1.0.0, =1.0.0, =2.3.4, =0.1.5, =0.1.1, =2.59.0, =3.0.0 and more Source cves: CVE-2024-32888 Source advisory: MEND:CVE-2024-32888...

CVE-2024-32888

The Amazon JDBC Driver for Redshift is a Type 4 JDBC driver that provides database connectivity through the standard JDBC application program interfaces APIs available in the Java Platform, Enterprise Editions. Prior to version 2.1.0.28, SQL injection is possible when using the non-default...