GitHub Advisoryadvisory · PyPI

GHSA-j4g3-3q8x-jxqp dbt-core's secret env vars written to package-lock.json in plaintext

LOW Published 2023-12-08 Modified 2023-12-08 Official page ↗
Ecosystem
PyPI
Packages
dbt-core
Severity
Low
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
Weaknesses
CWE-315
Reviewed
2023-12-08

Affected packages

• PyPI dbt-core: >= 1.7.0, < 1.7.3 → fixed in 1.7.3

Description

Impact When used to pull source code from a private repository using a Personal Access Token (PAT), some versions of dbt-core write a URL with the PAT in plaintext to the `package-lock.yml` file. Patches The bug has been fixed in dbt-core v1.7.3. Mitigations Remove any git URLs with plaintext secrets from `package-lock.yml` file(s) on servers, workstations, or in source control. Rotate any tokens that have been written to version-controlled files.

Related

Weakness · CWE (1)

  • CWE-315 Cleartext Storage of Sensitive Information in a Cookie weakness

References