GHSA-j4g3-3q8x-jxqp

Source

https://github.com/advisories/GHSA-j4g3-3q8x-jxqp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/12/GHSA-j4g3-3q8x-jxqp/GHSA-j4g3-3q8x-jxqp.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-j4g3-3q8x-jxqp

Published

2023-12-08T15:38:37Z

Modified

2024-12-04T05:42:25Z

Severity

3.2 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N CVSS Calculator

Summary

dbt-core's secret env vars written to package-lock.json in plaintext

Details

Impact

When used to pull source code from a private repository using a Personal Access Token (PAT), some versions of dbt-core write a URL with the PAT in plaintext to the package-lock.yml file.

Patches

The bug has been fixed in dbt-core v1.7.3.

Mitigations

Remove any git URLs with plaintext secrets from package-lock.yml file(s) on servers, workstations, or in source control. Rotate any tokens that have been written to version-controlled files.

Database specific

{
    "cwe_ids":  [
        "CWE-315"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2023-12-08T15:38:37Z",
    "nvd_published_at":  null,
    "severity":  "LOW"
}

References

Affected packages

PyPI / dbt-core

Package

Name: dbt-core; View open source insights on deps.dev
Purl: pkg:pypi/dbt-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.7.0

Fixed

1.7.3

Affected versions

1.*

1.7.0

1.7.1

1.7.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/12/GHSA-j4g3-3q8x-jxqp/GHSA-j4g3-3q8x-jxqp.json"