July 2023 Summaries

Metabase has addressed several vulnerabilities related to the H2 in-memory database, which allowed executable code injection via connection strings, by disabling support for H2 altogether. This decision follows multiple discoveries of vulnerabilities within a week by security researchers, leading to Metabase's removal of H2 to prevent future issues. Users are urged to upgrade their Metabase installations immediately to safeguard against these risks, particularly those running versions 43, 44, or 45. The vulnerabilities are not applicable to older versions below 0.43 or to users utilizing H2 as an application database within Metabase. Metabase Cloud customers have had vulnerable endpoints blocked and patches applied, while self-hosted users are provided with updated release versions. The company extends gratitude to several security researchers and teams for their roles in identifying and reporting these vulnerabilities.

A serious security vulnerability has been discovered in Metabase, prompting an urgent call for users to upgrade their installations immediately. This vulnerability allows unauthenticated attackers to execute arbitrary commands with the same privileges as the Metabase server, posing a significant risk to systems running versions X.43 or later, except for those using Metabase Cloud, which has already been patched. Although there is no evidence of exploitation, Metabase has released patched versions for both the enterprise and open-source editions to address the issue. Users are advised to update their installations via provided download links, and further information, including a CVE and an explanation, will be made available in two weeks to allow time for users to secure their systems.

Aligning metrics with business goals is essential to avoid focusing on vanity metrics that do not drive real growth. Developing a North Star metric is crucial as it provides long-term direction by encapsulating the core value and addressing key business problems and solutions. This process involves identifying the most critical business problems, ensuring that metrics are measurable, relevant, actionable, reliable, and understandable. Once established, these metrics should be stored in a Business Intelligence (BI) tool for easy tracking and visualization over time. Additionally, developing counter metrics helps to support and expand on the insights provided by the North Star metric, allowing a more comprehensive understanding of business performance. This approach facilitates the creation of a metrics store that standardizes metrics and enables efficient data grouping, ensuring that businesses can adapt and respond to new data while maintaining focus on solving the identified problems.