Detections
Analytics

SCA: security update for duckdb (GHSA-w2gf-jxc9-pf2q)

high Tenable Cloud Security Plugin ID 433791

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - DuckDB is a SQL database management system. In versions 1.0.0 and prior, content in filesystem is
 accessible for reading using `sniff_csv`, even with `enable_external_access=false`. This vulnerability
 provides an attacker with access to filesystem even when access is expected to be disabled and other
 similar functions do NOT provide access. There seem to be two vectors to this vulnerability. First, access
 to files that should otherwise not be allowed. Second, the content from a file can be read (e.g.
 `/etc/hosts`, `proc/self/environ`, etc) even though that doesn't seem to be the intent of the sniff_csv
 function. A fix for this issue is available in commit c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a and is
 expected to be part of version 1.1.0. (CVE-2024-41672)

See Also

https://github.com/advisories/GHSA-w2gf-jxc9-pf2q

Plugin Details

Severity: High

ID: 433791

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 8/19/2025

Updated: 6/1/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.51

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2024-41672

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 1/21/2025

Vulnerability Publication Date: 7/24/2024

Reference Information

CVE: CVE-2024-41672

cwe: CWE-200