[ADAP-1045] [CT-3413] Vulnerability in cryptography package used in DBT

[DanielMawdsley96]

Is this a new bug in dbt-core?

• I believe this is a new bug in dbt-core
• I have searched the existing issues, and I could not find an existing issue for this bug

Current Behavior

Snyk vulnerability found

✗ Denial of Service (DoS) [Medium Severity][https://security.snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-6050294] in [email protected]

introduced by [email protected] > [email protected] > [email protected] and 1 other path(s)

Expected Behavior

No vulnerability

Steps To Reproduce

Run snyk on GitHub repo containing DBT project

Relevant log output

No response

Environment

- OS: windows 
- Python: 3.11
- dbt: 1.7

Which database adapter are you using with dbt?

snowflake

Additional Context

@mikealfare: We need to pin this in setup.py with a lower bound as it's a transient dependency. It appears bumping snowflake-connector-python may also resolve this, but we need to regression test that change given our surface area on that package, so pinning cryptography directly would be faster for now.

[mikealfare]

This has been backported and merged, but not yet released. I'm reopening to make sure we confirm this is released.

[DanMawdsleyBA]

I'm still getting the issue I think there may be an additional update to the snowflake connector which also use the cryptography package. Currently it picks up snowflake-connector-python 3.4 but in 3.6 this issue has been fixed.

Issue seems to be in setup.py:

    install_requires=[
        "dbt-core~={}".format(dbt_core_version),
        "snowflake-connector-python[secure-local-storage]~=3.0",
        # installed via dbt-core but referenced directly; don't pin to avoid version conflicts with dbt-core
        "agate",
    ],

[mikealfare]

I'm still getting the issue I think there may be an additional update to the snowflake connector which also use the cryptography package. Currently it picks up snowflake-connector-python 3.4 but in 3.6 this issue has been fixed.

Issue seems to be in setup.py:

    install_requires=[
        "dbt-core~={}".format(dbt_core_version),
        "snowflake-connector-python[secure-local-storage]~=3.0",
        # installed via dbt-core but referenced directly; don't pin to avoid version conflicts with dbt-core
        "agate",
    ],

Ah, yes, it looks like only the dev requirements were fixed. I didn't realize it was a transient dependency as well. Thanks for the catch!

[VersusFacit]

Well today I learned we have multiple install channels to manage for the repo 😬