PT-2023-33033 · Dbt-Core · Dbt-Core

Publicado 2023-12-08 · Atualizado 2023-12-08

Positive Technologies (AI Summary)

CVSS v3.1

3.2

Baixa

Vetor base

AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions dbt-core versions prior to 1.7.3

Description The issue arises when dbt-core is used to pull source code from a private repository using a Personal Access Token (PAT). In this scenario, some versions of dbt-core write a URL with the PAT in plaintext to the package-lock.yml file. This could potentially expose sensitive information.

Recommendations For dbt-core versions prior to 1.7.3, update to version 1.7.3 or later to resolve the issue. As a temporary workaround, consider removing any git URLs with plaintext secrets from package-lock.yml file(s) on servers, workstations, or in source control. Rotate any tokens that have been written to version-controlled files to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-315

Identificadores relacionados

GHSA-J4G3-3Q8X-JXQP

Produtos afetados

Dbt-Core

Referências · 5

• https://github.com/dbt-labs/dbt-core · Nota
• https://github.com/dbt-labs/dbt-core/commit/09f5bb3dcffeda7a60ad2b22c2891f237628ecd1 · Nota
• https://github.com/dbt-labs/dbt-core/releases/tag/v1.7.3 · Nota
• https://github.com/dbt-labs/dbt-core/security/advisories/GHSA-j4g3-3q8x-jxqp · Nota
• https://osv.dev/vulnerability/GHSA-j4g3-3q8x-jxqp · Aviso do Fabricante