Skip to main content
Version: 24.3.x

Security Bulletin 2024-02-07-01

Abstract

The COPY INTO command does not verify users' SELECT privileges.

CVSS Qualitative Rating

Affected Releases

  • Dremio 24.0.0 through 24.3.2

Problem Description

In Affected Releases, an authenticated user who does not have the SELECT privilege on certain files/datasets can access those files/datasets by using the COPY INTO command. The user can copy the file/dataset to a new table and access the data there.

Resolution Actions

Upgrade to a Fixed Release that resolves the issue.

Fixed Releases

  • Dremio 24.3.3 and above