CVE-2024-26130

Advisory

Dbt-snowflake 1.8.0b2 updates its cryptography requirement to version 42.0.4 or newer, addressing security concerns highlighted by CVE-2024-26130.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Features

- Add new workflow for internal patch releases ([38](https://github.com/dbt-labs/dbt-snowflake/issues/38))

Fixes

- Acknowledge `send_anonymous_usage_stats` setting for python models ([830](https://github.com/dbt-labs/dbt-snowflake/issues/830))
- modify metadata queries to take into account object type of BASE TABLE being assigned to dynamic tables when was null previously ([934](https://github.com/dbt-labs/dbt-snowflake/issues/934))
- remove `private_key_path` from connection keys ([949](https://github.com/dbt-labs/dbt-snowflake/issues/949))

Under the Hood

- Add unit test for transaction semantics. ([912](https://github.com/dbt-labs/dbt-snowflake/issues/912))

Dependencies

- hard pin ddtrace to 2.3.0 ([932](https://github.com/dbt-labs/dbt-snowflake/pull/932))
- bump cryptography to 42.0.4 or higher for security callouts ([938](https://github.com/dbt-labs/dbt-snowflake/pull/938))
- Add `dbt-core` as a dependency to preserve backwards compatibility for installation ([964](https://github.com/dbt-labs/dbt-snowflake/pull/964))

Security

- Pin `black>=24.3` in `dev-requirements.txt` ([959](https://github.com/dbt-labs/dbt-snowflake/pull/959))

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26130
• https://github.com/dbt-labs/dbt-snowflake/pull/938