PyPI/duckdb CVE-2024-41672: high 7.5, EPSS 0.81%
sniff_csv provides filesystem access even when enable_external_access is disabled in duckdb
Action: Upgrade duckdb to 1.1.0 or later.
pip install duckdb==1.1.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.0.0 | 1.1.0 | - |
Fixed versions
| 1.1.0 |
Sources
- osv: GHSA-w2gf-jxc9-pf2q
- https://github.com/duckdb/duckdb/security/advisories/GHSA-w2gf-jxc9-pf2q
- https://nvd.nist.gov/vuln/detail/CVE-2024-41672
- https://github.com/duckdb/duckdb/pull/13133
- https://github.com/duckdb/duckdb/commit/c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a
- https://github.com/duckdb/duckdb
- https://github.com/pypa/advisory-database/tree/main/vulns/duckdb/PYSEC-2024-203.yaml
CVE-2024-41672 · published · modified · JSON