Advisoriesby Ibisdbt CoreGHSA-j4g3-3q8x-jxqp
dbt-core's secret env vars written to package-lock.json in plaintext
Fix: upgrade to 1.7.3 or later
Impact
When used to pull source code from a private repository using a Personal Access Token (PAT), some versions of dbt-core write a URL with the PAT in plaintext to the package-lock.yml file.
Patches
The bug has been fixed in [dbt-core v1.7.3](https://github.com/dbt-labs/dbt-core/releases/tag/v1.7.3).
Mitigations
Remove any git URLs with plaintext secrets from package-lock.yml file(s) on servers, workstations, or in source control. Rotate any tokens that have been written to version-controlled files.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| dbt-core PyPI | >= 1.7.0, < 1.7.3 | 1.7.3 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-315
More dbt Core advisories
All dbt Core
dbt has an implicit override for built-in materializations from installed packagesCVE-2024-40637fixed in 1.6.14 +1dbt allows Binding to an Unrestricted IP Address via socketsocketCVE-2024-36105fixed in 1.6.15 +2dbt uses a SQLparse version with a high vulnerabilityGHSA-p72q-h37j-3hq7fixed in 1.6.13 +1