ethyca-fides 2.23.2b0 vulnerabilities

Known vulnerabilities in the ethyca-fides package. This does not include vulnerabilities belonging to this package’s dependencies.

Vulnerability	Vulnerable Version
M Client-Side Enforcement of Server-Side Security ethyca-fides is an Open-source ecosystem for data privacy as code. Affected versions of this package are vulnerable to Client-Side Enforcement of Server-Side Security due to improper implementation of password policy validations in the `/api/v1/user/accept-invite` endpoint. An attacker can compromise a user's account by setting an extremely weak password during the initial account setup process by bypassing client-side password complexity checks. How to fix Client-Side Enforcement of Server-Side Security? Upgrade `ethyca-fides` to version 2.50.0rc0 or higher.	[,2.50.0rc0)
M Improper Control of Generation of Code ('Code Injection') ethyca-fides is an Open-source ecosystem for data privacy as code. Affected versions of this package are vulnerable to Improper Control of Generation of Code ('Code Injection') due to improper input sanitization and lack of rendering environment restrictions in the Email Templating feature. An attacker can execute arbitrary code on the server by injecting malicious templates. Note: This is only exploitable if the attacker has `Owner` or `Contributor` role access. OAuth clients with the `messaging-template:update` scope are also authorized to use the PUT `/api/v1/messaging/templates/` Fides Webserver API endpoint and may also exploit this vulnerability. How to fix Improper Control of Generation of Code ('Code Injection')? Upgrade `ethyca-fides` to version 2.44.0 or higher.	[2.19.0,2.44.0)
M Timing Attack ethyca-fides is an Open-source ecosystem for data privacy as code. Affected versions of this package are vulnerable to Timing Attack due to the discrepancy in response times between valid and invalid usernames in the login endpoint. An attacker can determine the existence of valid usernames by analyzing the time it takes for the server to respond to login requests. By exploiting this vulnerability, an attacker can enumerate users on the system. How to fix Timing Attack? Upgrade `ethyca-fides` to version 2.44.0 or higher.	[,2.44.0)
M Exposure of Sensitive Information to an Unauthorized Actor ethyca-fides is an Open-source ecosystem for data privacy as code. Affected versions of this package are vulnerable to Exposure of Sensitive Information to an Unauthorized Actor through the `SERVER_SIDE_FIDES_API_URL` environment variable. An attacker can obtain sensitive server-side configuration details by making an unauthorized HTTP GET request. How to fix Exposure of Sensitive Information to an Unauthorized Actor? Upgrade `ethyca-fides` to version 2.39.2 or higher.	[2.19.0,2.39.2)
M Information Exposure Through an Error Message ethyca-fides is an Open-source ecosystem for data privacy as code. Affected versions of this package are vulnerable to Information Exposure Through an Error Message due to a flaw in the internal function handling `sensitive` annotations, which fails to mask nested sensitive fields properly. An attacker can access sensitive data such as private keys by exploiting this vulnerability in the API endpoint exposure. This is only exploitable if the `BigQuery` connection configuration secrets are used, as other connection types with non-nested sensitive fields are not affected. How to fix Information Exposure Through an Error Message? Upgrade `ethyca-fides` to version 2.37.0 or higher.	[,2.37.0)
L Insertion of Sensitive Information into Log File ethyca-fides is an Open-source ecosystem for data privacy as code. Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File due to improper escaping of the password string in the webserver configuration. An attacker can access part of the database password by examining error logs where this information is inadvertently logged. How to fix Insertion of Sensitive Information into Log File? Upgrade `ethyca-fides` to version 2.37.0 or higher.	[,2.37.0)
H Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) ethyca-fides is an Open-source ecosystem for data privacy as code. Affected versions of this package are vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) when the `subject_identity_verification_required` function is enabled. An attacker can predict all future one-time code values during the lifetime of the backend python process by generating several hundred consecutive one-time codes. This allows the attacker to submit a verified data erasure request, resulting in deletion of data for the targeted user and submit a verified consent request, modifying a user's privacy preferences. This is only exploitable if `subject_identity_verification_required` in the `[execution]` section of `fides.toml` or the env var `FIDES__EXECUTION__SUBJECT_IDENTITY_VERIFICATION_REQUIRED` is set to `True` on the fides webserver backend. How to fix Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)? Upgrade `ethyca-fides` to version 2.24.0 or higher.	[,2.24.0)
M Cross-site Scripting (XSS) ethyca-fides is an Open-source ecosystem for data privacy as code. Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the `HTML-Formatted DSR Packages` function. An attacker can inject HTML that can be abused for phishing attacks or malicious JavaScript code execution, but only in the context of the data subject's browser accessing a HTML page using the `file://` protocol by exploiting the lack of validation of input coming from connected systems and data stores. Mitigation: This vulnerability can be mitigated by using `json` or `csv` instead of `html` as the package format in the storage destination. How to fix Cross-site Scripting (XSS)? Upgrade `ethyca-fides` to version 2.23.3 or higher.	[2.15.1,2.23.3)

Vulnerability

Vulnerable Version

Client-Side Enforcement of Server-Side Security

ethyca-fides is an Open-source ecosystem for data privacy as code.

Affected versions of this package are vulnerable to Client-Side Enforcement of Server-Side Security due to improper implementation of password policy validations in the /api/v1/user/accept-invite endpoint. An attacker can compromise a user's account by setting an extremely weak password during the initial account setup process by bypassing client-side password complexity checks.

How to fix Client-Side Enforcement of Server-Side Security?

Upgrade ethyca-fides to version 2.50.0rc0 or higher.

[,2.50.0rc0)

Improper Control of Generation of Code ('Code Injection')

ethyca-fides is an Open-source ecosystem for data privacy as code.

Affected versions of this package are vulnerable to Improper Control of Generation of Code ('Code Injection') due to improper input sanitization and lack of rendering environment restrictions in the Email Templating feature. An attacker can execute arbitrary code on the server by injecting malicious templates.

Note:

This is only exploitable if the attacker has Owner or Contributor role access.

OAuth clients with the messaging-template:update scope are also authorized to use the PUT /api/v1/messaging/templates/ Fides Webserver API endpoint and may also exploit this vulnerability.

How to fix Improper Control of Generation of Code ('Code Injection')?

Upgrade ethyca-fides to version 2.44.0 or higher.

[2.19.0,2.44.0)

Timing Attack

ethyca-fides is an Open-source ecosystem for data privacy as code.

Affected versions of this package are vulnerable to Timing Attack due to the discrepancy in response times between valid and invalid usernames in the login endpoint. An attacker can determine the existence of valid usernames by analyzing the time it takes for the server to respond to login requests. By exploiting this vulnerability, an attacker can enumerate users on the system.

How to fix Timing Attack?

Upgrade ethyca-fides to version 2.44.0 or higher.

[,2.44.0)

Exposure of Sensitive Information to an Unauthorized Actor

ethyca-fides is an Open-source ecosystem for data privacy as code.

Affected versions of this package are vulnerable to Exposure of Sensitive Information to an Unauthorized Actor through the SERVER_SIDE_FIDES_API_URL environment variable. An attacker can obtain sensitive server-side configuration details by making an unauthorized HTTP GET request.

How to fix Exposure of Sensitive Information to an Unauthorized Actor?

Upgrade ethyca-fides to version 2.39.2 or higher.

[2.19.0,2.39.2)

Information Exposure Through an Error Message

ethyca-fides is an Open-source ecosystem for data privacy as code.

Affected versions of this package are vulnerable to Information Exposure Through an Error Message due to a flaw in the internal function handling sensitive annotations, which fails to mask nested sensitive fields properly. An attacker can access sensitive data such as private keys by exploiting this vulnerability in the API endpoint exposure. This is only exploitable if the BigQuery connection configuration secrets are used, as other connection types with non-nested sensitive fields are not affected.

How to fix Information Exposure Through an Error Message?

Upgrade ethyca-fides to version 2.37.0 or higher.

[,2.37.0)

Insertion of Sensitive Information into Log File

ethyca-fides is an Open-source ecosystem for data privacy as code.

Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File due to improper escaping of the password string in the webserver configuration. An attacker can access part of the database password by examining error logs where this information is inadvertently logged.

How to fix Insertion of Sensitive Information into Log File?

Upgrade ethyca-fides to version 2.37.0 or higher.

[,2.37.0)

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

ethyca-fides is an Open-source ecosystem for data privacy as code.

Affected versions of this package are vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) when the subject_identity_verification_required function is enabled. An attacker can predict all future one-time code values during the lifetime of the backend python process by generating several hundred consecutive one-time codes. This allows the attacker to submit a verified data erasure request, resulting in deletion of data for the targeted user and submit a verified consent request, modifying a user's privacy preferences. This is only exploitable if subject_identity_verification_required in the [execution] section of fides.toml or the env var FIDES__EXECUTION__SUBJECT_IDENTITY_VERIFICATION_REQUIRED is set to True on the fides webserver backend.

How to fix Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)?

Upgrade ethyca-fides to version 2.24.0 or higher.

[,2.24.0)

Cross-site Scripting (XSS)

ethyca-fides is an Open-source ecosystem for data privacy as code.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the HTML-Formatted DSR Packages function. An attacker can inject HTML that can be abused for phishing attacks or malicious JavaScript code execution, but only in the context of the data subject's browser accessing a HTML page using the file:// protocol by exploiting the lack of validation of input coming from connected systems and data stores.

Mitigation: This vulnerability can be mitigated by using json or csv instead of html as the package format in the storage destination.

How to fix Cross-site Scripting (XSS)?

Upgrade ethyca-fides to version 2.23.3 or higher.

[2.15.1,2.23.3)

ethyca-fides@2.23.2b0 vulnerabilities

Open-source ecosystem for data privacy as code.

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

How to fix?