Information Exposure Through an Error Message Affecting ethyca-fides package, versions [,2.37.0)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-ETHYCAFIDES-7172781
- published 31 May 2024
- disclosed 30 May 2024
- credit Adam Sachs
Introduced: 30 May 2024
CVE-2024-35189 Open this link in a new tabHow to fix?
Upgrade ethyca-fides to version 2.37.0 or higher.
Overview
ethyca-fides is an Open-source ecosystem for data privacy as code.
Affected versions of this package are vulnerable to Information Exposure Through an Error Message due to a flaw in the internal function handling sensitive annotations, which fails to mask nested sensitive fields properly. An attacker can access sensitive data such as private keys by exploiting this vulnerability in the API endpoint exposure. This is only exploitable if the BigQuery connection configuration secrets are used, as other connection types with non-nested sensitive fields are not affected.