dbt Labs security advisories
4 advisories across dbt Core
| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 172024 | dbt has an implicit override for built-in materializations from installed packages CVE-2024-40637Low4.2fixed in 1.6.14, 1.7.14 | Low4.2 | 1.6.14, 1.7.14 |
| May 282024 | dbt allows Binding to an Unrestricted IP Address via socketsocket CVE-2024-36105Medium5.3fixed in 1.6.15, 1.7.15, 1.8.1 | Medium5.3 | 1.6.15, 1.7.15, 1.8.1 |
| Apr 222024 | dbt uses a SQLparse version with a high vulnerability GHSA-p72q-h37j-3hq7High7.5fixed in 1.6.13, 1.7.13 | High7.5 | 1.6.13, 1.7.13 |
| Dec 82023 | dbt-core's secret env vars written to package-lock.json in plaintext GHSA-j4g3-3q8x-jxqpLow3.2fixed in 1.7.3 | Low3.2 | 1.7.3 |
About dbt Labs
dbt, the standard for transforming data in the warehouse: dbt Core, the dbt Fusion engine and the dbt platform.
Elsewhere on fru.dev: Acquisitions · Paydays · Releases · Repos · TechConf