dbt CoreGHSA-j4g3-3q8x-jxqp
dbt-core's secret env vars written to package-lock.json in plaintext
Low3.2Published Dec 8, 2023 · updated Dec 4, 2024
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| dbt-core PyPI | >= 1.7.0, < 1.7.3 | 1.7.3 |
Details and references
### Impact When used to pull source code from a private repository using a Personal Access Token (PAT), some versions of dbt-core write a URL with the PAT in plaintext to the `package-lock.yml` file. ### Patches The bug has been fixed in [dbt-core v1.7.3](https://github.com/dbt-labs/dbt-core/releases/tag/v1.7.3). ### Mitigations Remove any git URLs with plaintext secrets from `package-lock.yml` file(s) on servers, workstations, or in source control. Rotate any tokens that have been written to version-controlled files.
- CVSS 3.1
- CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-315
More dbt Core advisories
All dbt Core| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Apr 222024 | dbt uses a SQLparse version with a high vulnerability GHSA-p72q-h37j-3hq7High7.5fixed in 1.6.13, 1.7.13 | High7.5 | 1.6.13, 1.7.13 |
| May 282024 | dbt allows Binding to an Unrestricted IP Address via socketsocket CVE-2024-36105Medium5.3fixed in 1.6.15, 1.7.15, 1.8.1 | Medium5.3 | 1.6.15, 1.7.15, 1.8.1 |
| Jul 172024 | dbt has an implicit override for built-in materializations from installed packages CVE-2024-40637Low4.2fixed in 1.6.14, 1.7.14 | Low4.2 | 1.6.14, 1.7.14 |