CVE-2023-32681

Advisory

Dbt-databricks 1.5.6 updates its dependency 'databricks-sdk' to v0.9.0 to include a secure version of 'requests'.
https://github.com/databricks/dbt-databricks/pull/460

Affected package

Affected versions

Fixed versions

Vulnerability changelog

What's Changed
* Backport fixes from 1.6.x by benc-db in https://github.com/databricks/dbt-databricks/pull/465

Includes the following:

- Updated the Databricks SDK dependency so as to prevent reliance on an insecure version of requests ([460](https://github.com/databricks/dbt-databricks/pull/460))
- Update logic around submitting python jobs so that if the cluster is already starting, just wait for it to start rather than failing ([461](https://github.com/databricks/dbt-databricks/pull/461))
- Add `fetchmany`, resolves 408 (Thanks NodeJSmith) ([409](https://github.com/databricks/dbt-databricks/pull/409))
- Relaxed the constraint on databricks-sql-connector to allow newer versions ([436](https://github.com/databricks/dbt-databricks/pull/436))
- Follow up: re-implement fix for issue where the show tables extended command is limited to 2048 characters. ([326](https://github.com/databricks/dbt-databricks/pull/326)). Set `DBT_DESCRIBE_TABLE_2048_CHAR_BYPASS` to `true` to enable this behaviour.

**Full Changelog**: https://github.com/databricks/dbt-databricks/compare/v1.5.5...v1.5.6

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32681