How severe is CVE-2024-40637?

This vulnerability has a severity rating of HIGH with a CVSS score of 7.8 out of 10.

What type of vulnerability is CVE-2024-40637?

This is classified as CWE-74, which is a common weakness in software security.

CVE-2024-40637 - HIGH Severity | CVSS 7.8

Vulnerability Description

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. When a user installs a package in dbt, it has the ability to override macros, materializations, and other core components of dbt. This is by design, as it allows packages to extend and customize dbt's functionality. However, this also means that a malicious package could potentially override these components with harmful code. This issue has been fixed in versions 1.8.0, 1.6.14 and 1.7.14. Users are advised to upgrade. There are no kn own workarounds for this vulnerability. Users updating to either 1.6.14 or 1.7.14 will need to set `flags.require_explicit_package_overrides_for_builtin_materializations: False` in their configuration in `dbt_project.yml`.

Related Vulnerabilities

CVE-2010-4654

HIGH

CVSS:7.8(High)

poppler before 0.16.3 has malformed commands that may cause corruption of the internal stack.

CWE-742010

CVE-2014-7844

HIGH

CVSS:7.8(High)

BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via a crafted email address.

CWE-742014

CVE-2014-7952

HIGH

CVSS:7.8(High)

The backup mechanism in the adb tool in Android might allow attackers to inject additional applications (APKs) and execute arbitrary code by leveraging failure to filter application data streams.

CWE-742014

CVE-2015-1975

HIGH

CVSS:7.8(High)

The web administration tool in IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, and 6.3 before iFix 37 and IBM Security Directory Server 6.3.1 before iF...

CWE-742015

CVE-2017-1000052

HIGH

CVSS:7.8(High)

Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to null byte injection in the Plug.Static component, which may allow users to bypass filetype restrictions.

CWE-742017

CVE-2017-1000454

HIGH

CVSS:7.8(High)

CMS Made Simple 2.1.6, 2.2, 2.2.1 are vulnerable to Smarty Template Injection in some core components, resulting in local file read before 2.2, and local file inclusion since 2.2.1

CWE-742017