Homepage
About Snyk

ethyca-fides@2.34.2b1 vulnerabilities

Open-source ecosystem for data privacy as code.

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the ethyca-fides package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Information Exposure Through an Error Message

ethyca-fides is an Open-source ecosystem for data privacy as code.

Affected versions of this package are vulnerable to Information Exposure Through an Error Message due to a flaw in the internal function handling sensitive annotations, which fails to mask nested sensitive fields properly. An attacker can access sensitive data such as private keys by exploiting this vulnerability in the API endpoint exposure. This is only exploitable if the BigQuery connection configuration secrets are used, as other connection types with non-nested sensitive fields are not affected.

How to fix Information Exposure Through an Error Message?

Upgrade ethyca-fides to version 2.37.0 or higher.

[,2.37.0)
  • L
Insertion of Sensitive Information into Log File

ethyca-fides is an Open-source ecosystem for data privacy as code.

Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File due to improper escaping of the password string in the webserver configuration. An attacker can access part of the database password by examining error logs where this information is inadvertently logged.

How to fix Insertion of Sensitive Information into Log File?

Upgrade ethyca-fides to version 2.37.0 or higher.

[,2.37.0)
Go back to all versions of this package