Homepage

ethyca-fides@1.9.9 vulnerabilities

Open-source ecosystem for data privacy as code.

  • latest version

    2.59.1

  • latest non vulnerable version

    2.59.2rc0

  • first published

    2 years ago

  • latest version published

    5 days ago

  • licenses detected

  • View ethyca-fides package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the ethyca-fides package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Client-Side Enforcement of Server-Side Security

    ethyca-fides is an Open-source ecosystem for data privacy as code.

    Affected versions of this package are vulnerable to Client-Side Enforcement of Server-Side Security due to improper implementation of password policy validations in the /api/v1/user/accept-invite endpoint. An attacker can compromise a user's account by setting an extremely weak password during the initial account setup process by bypassing client-side password complexity checks.

    How to fix Client-Side Enforcement of Server-Side Security?

    Upgrade ethyca-fides to version 2.50.0rc0 or higher.

    [,2.50.0rc0)
    • M
    Timing Attack

    ethyca-fides is an Open-source ecosystem for data privacy as code.

    Affected versions of this package are vulnerable to Timing Attack due to the discrepancy in response times between valid and invalid usernames in the login endpoint. An attacker can determine the existence of valid usernames by analyzing the time it takes for the server to respond to login requests. By exploiting this vulnerability, an attacker can enumerate users on the system.

    How to fix Timing Attack?

    Upgrade ethyca-fides to version 2.44.0 or higher.

    [,2.44.0)
    • M
    Information Exposure Through an Error Message

    ethyca-fides is an Open-source ecosystem for data privacy as code.

    Affected versions of this package are vulnerable to Information Exposure Through an Error Message due to a flaw in the internal function handling sensitive annotations, which fails to mask nested sensitive fields properly. An attacker can access sensitive data such as private keys by exploiting this vulnerability in the API endpoint exposure. This is only exploitable if the BigQuery connection configuration secrets are used, as other connection types with non-nested sensitive fields are not affected.

    How to fix Information Exposure Through an Error Message?

    Upgrade ethyca-fides to version 2.37.0 or higher.

    [,2.37.0)
    • L
    Insertion of Sensitive Information into Log File

    ethyca-fides is an Open-source ecosystem for data privacy as code.

    Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File due to improper escaping of the password string in the webserver configuration. An attacker can access part of the database password by examining error logs where this information is inadvertently logged.

    How to fix Insertion of Sensitive Information into Log File?

    Upgrade ethyca-fides to version 2.37.0 or higher.

    [,2.37.0)
    • M
    Race Condition

    ethyca-fides is an Open-source ecosystem for data privacy as code.

    Affected versions of this package are vulnerable to Race Condition during the initialization of the FidesConfig class. This vulnerability can lead to unexpected behavior or incorrect security configurations if two threads attempt to modify the security attribute simultaneously.

    How to fix Race Condition?

    Upgrade ethyca-fides to version 2.1.0 or higher.

    [,2.1.0)
    • H
    Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

    ethyca-fides is an Open-source ecosystem for data privacy as code.

    Affected versions of this package are vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) when the subject_identity_verification_required function is enabled. An attacker can predict all future one-time code values during the lifetime of the backend python process by generating several hundred consecutive one-time codes. This allows the attacker to submit a verified data erasure request, resulting in deletion of data for the targeted user and submit a verified consent request, modifying a user's privacy preferences. This is only exploitable if subject_identity_verification_required in the [execution] section of fides.toml or the env var FIDES__EXECUTION__SUBJECT_IDENTITY_VERIFICATION_REQUIRED is set to True on the fides webserver backend.

    How to fix Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)?

    Upgrade ethyca-fides to version 2.24.0 or higher.

    [,2.24.0)
    • M
    Server-side Request Forgery (SSRF)

    ethyca-fides is an Open-source ecosystem for data privacy as code.

    Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the saas_util.py and authenticated_client.py files. An attacker can perform arbitrary requests to internal systems and exfiltrate data outside the environment by uploading specially crafted YAML dataset and config files.

    Note: This is only exploitable if the API client has the CONNECTOR_TEMPLATE_REGISTER authorization scope, which is typically restricted to highly privileged users such as root users and users with the owner role.

    How to fix Server-side Request Forgery (SSRF)?

    Upgrade ethyca-fides to version 2.22.1 or higher.

    [,2.22.1)
    • M
    Information Exposure Through Sent Data

    ethyca-fides is an Open-source ecosystem for data privacy as code.

    Affected versions of this package are vulnerable to Information Exposure Through Sent Data via the api/v1/config endpoint. An attacker can retrieve sensitive configuration information, by exploiting the API.

    Note: This is only exploitable if the user has roles lower than the owner role, such as the viewer role.

    How to fix Information Exposure Through Sent Data?

    Upgrade ethyca-fides to version 2.22.1 or higher.

    [,2.22.1)
    • M
    Cross-site Scripting (XSS)

    ethyca-fides is an Open-source ecosystem for data privacy as code.

    Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in src/fides/api/schemas/privacy_experience.py. An attacker can trigger JavaScript execution on an integrated website by crafting a payload in the privacy policy URL.

    Note:

    This exploitation is limited to Admin UI users with the contributor role or higher.

    How to fix Cross-site Scripting (XSS)?

    Upgrade ethyca-fides to version 2.22.1 or higher.

    [,2.22.1)
    • H
    Directory Traversal

    ethyca-fides is an Open-source ecosystem for data privacy as code.

    Affected versions of this package are vulnerable to Directory Traversal such that it allows remote attackers to access arbitrary files on the fides webserver container's filesystem.

    Note:

    If the Fides webserver API is not directly accessible to attackers and is instead deployed behind a reverse proxy as recommended in Ethyca's security best practice documentation, and the reverse proxy is an AWS application load balancer, the vulnerability can't be exploited by these attackers. An AWS application load balancer will reject this attack with a 400 error. Additionally, any secrets supplied to the container using environment variables rather than a fides.toml configuration file are not affected by this vulnerability.

    How to fix Directory Traversal?

    Upgrade ethyca-fides to version 2.15.1 or higher.

    [,2.15.1)
    Go back to all versions of this package