GHSA-j4g3-3q8x-jxqp

    Dashboard / Vulnerabilities / GHSA-j4g3-3q8x-jxqp

    GHSA-j4g3-3q8x-jxqp

    Published: 8 Dec 2023Last Modified: 4 Dec 2024

    Summary: dbt-core's secret env vars written to package-lock.json in plaintext

    Details: ### Impact When used to pull source code from a private repository using a Personal Access Token (PAT), some versions of dbt-core write a URL with the PAT in plaintext to the `package-lock.yml` file. ### Patches The bug has been fixed in [dbt-core v1.7.3](https://github.com/dbt-labs/dbt-core/releases/tag/v1.7.3). ### Mitigations Remove any git URLs with plaintext secrets from `package-lock.yml` file(s) on servers, workstations, or in source control. Rotate any tokens that have been written to version-controlled files.

    References: https://github.com/dbt-labs/dbt-core/security/advisories/GHSA-j4g3-3q8x-jxqp, https://github.com/dbt-labs/dbt-core/commit/09f5bb3dcffeda7a60ad2b22c2891f237628ecd1, https://github.com/dbt-labs/dbt-core, https://github.com/dbt-labs/dbt-core/releases/tag/v1.7.3

    Affected packages

    Package

    Name: dbt-core

    Purl: pkg:pypi/dbt-core

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 1.7.0
    Fixed -1.7.3

    Affected versions

    1.7.0
    1.7.1
    1.7.2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-j4g3-3q8x-jxqp | CVE-DB