GHSA-p72q-h37j-3hq7

Source

https://github.com/advisories/GHSA-p72q-h37j-3hq7

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-p72q-h37j-3hq7/GHSA-p72q-h37j-3hq7.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-p72q-h37j-3hq7

Published

2024-04-22T22:17:59Z

Modified

2024-12-05T05:28:27Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

dbt uses a SQLparse version with a high vulnerability

Details

Summary

Using a version of sqlparse that has a security vulnerability and no way to update in current version of dbt core. Snyk recommends using sqlparse==0.5 but this causes a conflict with dbt. Snyk states the issues is a recursion error: SNYK-PYTHON-SQLPARSE-6615674.

Details

Dependency conflict error message:

The conflict is caused by:
    The user requested sqlparse==0.5
    dbt-core 1.7.10 depends on sqlparse<0.5 and >=0.2.3

Resolution was to pin sqlparse >=0.5.0, <0.6.0 in dbt-core, patched in 1.6.13 and 1.7.13.

PoC

From Snyk:

import sqlparse
sqlparse.parse('[' * 10000 + ']' * 10000)

Impact

Snyk classifies it as high 7.5/10.

Patches

The bug has been fixed in dbt-core v1.6.13 and dbt-core v1.7.13.

Mitigations

Bump dbt-core 1.6 and 1.7 dependencies to 1.6.13 and 1.7.13 respectively

Database specific

{
    "cwe_ids":  [
        "CWE-673"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2024-04-22T22:17:59Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

Affected packages

PyPI / dbt-core

Package

Name: dbt-core; View open source insights on deps.dev
Purl: pkg:pypi/dbt-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.6.0

Fixed

1.6.13

Affected versions

1.*

1.6.0

1.6.1rc1

1.6.1

1.6.2

1.6.3

1.6.4

1.6.5

1.6.6

1.6.7

1.6.8

1.6.9

1.6.10

1.6.11

1.6.12

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-p72q-h37j-3hq7/GHSA-p72q-h37j-3hq7.json"

PyPI / dbt-core

Package

Name: dbt-core; View open source insights on deps.dev
Purl: pkg:pypi/dbt-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.7.0

Fixed

1.7.13

Affected versions

1.*

1.7.0

1.7.1

1.7.2

1.7.3

1.7.4

1.7.5

1.7.6

1.7.7

1.7.8

1.7.9

1.7.10

1.7.11

1.7.12

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-p72q-h37j-3hq7/GHSA-p72q-h37j-3hq7.json"