{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-35189", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-05-10T14:24:24.341Z", "datePublished": "2024-05-30T19:47:43.080Z", "dateUpdated": "2024-08-02T03:07:46.734Z"}, "containers": {"cna": {"title": "Sensitive Data Disclosure Vulnerability in Connection Configuration Endpoints in Fides", "problemTypes": [{"descriptions": [{"cweId": "CWE-201", "lang": "en", "description": "CWE-201: Insertion of Sensitive Information Into Sent Data", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/ethyca/fides/security/advisories/GHSA-rcvg-jj3g-rj7c", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ethyca/fides/security/advisories/GHSA-rcvg-jj3g-rj7c"}, {"name": "https://cloud.google.com/iam/docs/key-rotation", "tags": ["x_refsource_MISC"], "url": "https://cloud.google.com/iam/docs/key-rotation"}], "affected": [{"vendor": "ethyca", "product": "fides", "versions": [{"version": "< 2.37.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-05-30T19:47:43.080Z"}, "descriptions": [{"lang": "en", "value": "Fides is an open-source privacy engineering platform. The Fides webserver has a number of endpoints that retrieve `ConnectionConfiguration` records and their associated `secrets` which _can_ contain sensitive data (e.g. passwords, private keys, etc.). These `secrets` are stored encrypted at rest (in the application database), and the associated endpoints are not meant to expose that sensitive data in plaintext to API clients, as it could be compromising. Fides's developers have available to them a Pydantic field-attribute (`sensitive`) that they can annotate as `True` to indicate that a given secret field should not be exposed via the API. The application has an internal function that uses `sensitive` annotations to mask the sensitive fields with a `\"**********\"` placeholder value. This vulnerability is due to a bug in that function, which prevented `sensitive` API model fields that were _nested_ below the root-level of a `secrets` object from being masked appropriately. Only the `BigQuery` connection configuration secrets meets these criteria: the secrets schema has a nested sensitive `keyfile_creds.private_key` property that is exposed in plaintext via the APIs. Connection types other than `BigQuery` with sensitive fields at the root-level that are not nested are properly masked with the placeholder and are not affected by this vulnerability. This vulnerability has been patched in Fides version 2.37.0. Users are advised to upgrade to this version or later to secure their systems against this threat. Users are also advised to rotate any Google Cloud secrets used for BigQuery integrations in their Fides deployments. There are no known workarounds for this vulnerability."}], "source": {"advisory": "GHSA-rcvg-jj3g-rj7c", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "ethyca", "product": "fides", "cpes": ["cpe:2.3:a:ethyca:fides:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "2.37.0", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-12T20:38:12.376244Z", "id": "CVE-2024-35189", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-12T20:38:18.435Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:07:46.734Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/ethyca/fides/security/advisories/GHSA-rcvg-jj3g-rj7c", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/ethyca/fides/security/advisories/GHSA-rcvg-jj3g-rj7c"}, {"name": "https://cloud.google.com/iam/docs/key-rotation", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://cloud.google.com/iam/docs/key-rotation"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/ethyca/fides/security/advisories/GHSA-rcvg-jj3g-rj7c", "name": "https://github.com/ethyca/fides/security/advisories/GHSA-rcvg-jj3g-rj7c", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://cloud.google.com/iam/docs/key-rotation", "name": "https://cloud.google.com/iam/docs/key-rotation", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:07:46.734Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-35189", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-12T20:38:12.376244Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:ethyca:fides:*:*:*:*:*:*:*:*"], "vendor": "ethyca", "product": "fides", "versions": [{"status": "affected", "version": "0", "lessThan": "2.37.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-12T20:37:13.240Z"}}], "cna": {"title": "Sensitive Data Disclosure Vulnerability in Connection Configuration Endpoints in Fides", "source": {"advisory": "GHSA-rcvg-jj3g-rj7c", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "ethyca", "product": "fides", "versions": [{"status": "affected", "version": "< 2.37.0"}]}], "references": [{"url": "https://github.com/ethyca/fides/security/advisories/GHSA-rcvg-jj3g-rj7c", "name": "https://github.com/ethyca/fides/security/advisories/GHSA-rcvg-jj3g-rj7c", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://cloud.google.com/iam/docs/key-rotation", "name": "https://cloud.google.com/iam/docs/key-rotation", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Fides is an open-source privacy engineering platform. The Fides webserver has a number of endpoints that retrieve `ConnectionConfiguration` records and their associated `secrets` which _can_ contain sensitive data (e.g. passwords, private keys, etc.). These `secrets` are stored encrypted at rest (in the application database), and the associated endpoints are not meant to expose that sensitive data in plaintext to API clients, as it could be compromising. Fides's developers have available to them a Pydantic field-attribute (`sensitive`) that they can annotate as `True` to indicate that a given secret field should not be exposed via the API. The application has an internal function that uses `sensitive` annotations to mask the sensitive fields with a `\"**********\"` placeholder value. This vulnerability is due to a bug in that function, which prevented `sensitive` API model fields that were _nested_ below the root-level of a `secrets` object from being masked appropriately. Only the `BigQuery` connection configuration secrets meets these criteria: the secrets schema has a nested sensitive `keyfile_creds.private_key` property that is exposed in plaintext via the APIs. Connection types other than `BigQuery` with sensitive fields at the root-level that are not nested are properly masked with the placeholder and are not affected by this vulnerability. This vulnerability has been patched in Fides version 2.37.0. Users are advised to upgrade to this version or later to secure their systems against this threat. Users are also advised to rotate any Google Cloud secrets used for BigQuery integrations in their Fides deployments. There are no known workarounds for this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-201", "description": "CWE-201: Insertion of Sensitive Information Into Sent Data"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-05-30T19:47:43.080Z"}}}, "cveMetadata": {"cveId": "CVE-2024-35189", "state": "PUBLISHED", "dateUpdated": "2024-08-02T03:07:46.734Z", "dateReserved": "2024-05-10T14:24:24.341Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-05-30T19:47:43.080Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"descriptions": [{"lang": "en", "value": "Fides is an open-source privacy engineering platform. The Fides webserver has a number of endpoints that retrieve `ConnectionConfiguration` records and their associated `secrets` which _can_ contain sensitive data (e.g. passwords, private keys, etc.). These `secrets` are stored encrypted at rest (in the application database), and the associated endpoints are not meant to expose that sensitive data in plaintext to API clients, as it could be compromising. Fides's developers have available to them a Pydantic field-attribute (`sensitive`) that they can annotate as `True` to indicate that a given secret field should not be exposed via the API. The application has an internal function that uses `sensitive` annotations to mask the sensitive fields with a `\"**********\"` placeholder value. This vulnerability is due to a bug in that function, which prevented `sensitive` API model fields that were _nested_ below the root-level of a `secrets` object from being masked appropriately. Only the `BigQuery` connection configuration secrets meets these criteria: the secrets schema has a nested sensitive `keyfile_creds.private_key` property that is exposed in plaintext via the APIs. Connection types other than `BigQuery` with sensitive fields at the root-level that are not nested are properly masked with the placeholder and are not affected by this vulnerability. This vulnerability has been patched in Fides version 2.37.0. Users are advised to upgrade to this version or later to secure their systems against this threat. Users are also advised to rotate any Google Cloud secrets used for BigQuery integrations in their Fides deployments. There are no known workarounds for this vulnerability."}, {"lang": "es", "value": "Fides es una plataforma de ingenier\u00eda de privacidad de c\u00f3digo abierto. El servidor web de Fides tiene una serie de endpoints que recuperan registros de \"Configuraci\u00f3n de conexi\u00f3n\" y sus \"secretos\" asociados que _pueden_ contener datos confidenciales (por ejemplo, contrase\u00f1as, claves privadas, etc.). Estos \"secretos\" se almacenan cifrados en reposo (en la base de datos de la aplicaci\u00f3n) y los endpoints asociados no est\u00e1n destinados a exponer esos datos confidenciales en texto sin formato a los clientes API, ya que podr\u00edan ser comprometedores. Los desarrolladores de Fides tienen a su disposici\u00f3n un atributo de campo Pydantic (\"sensible\") que pueden anotar como \"Verdadero\" para indicar que un campo secreto determinado no debe exponerse a trav\u00e9s de la API. La aplicaci\u00f3n tiene una funci\u00f3n interna que utiliza anotaciones \"sensibles\" para enmascarar los campos sensibles con un valor de marcador de posici\u00f3n \"**********\". Esta vulnerabilidad se debe a un error en esa funci\u00f3n, que imped\u00eda que los campos del modelo API \"sensibles\" que estaban _anidados_ debajo del nivel ra\u00edz de un objeto \"secreto\" se enmascararan adecuadamente. Solo los secretos de configuraci\u00f3n de conexi\u00f3n de \"BigQuery\" cumplen estos criterios: el esquema de secretos tiene una propiedad sensible anidada \"keyfile_creds.private_key\" que se expone en texto sin formato a trav\u00e9s de las API. Los tipos de conexi\u00f3n distintos de \"BigQuery\" con campos confidenciales en el nivel ra\u00edz que no est\u00e1n anidados se enmascaran correctamente con el marcador de posici\u00f3n y no se ven afectados por esta vulnerabilidad. Esta vulnerabilidad ha sido parcheada en la versi\u00f3n 2.37.0 de Fides. Se recomienda a los usuarios que actualicen a esta versi\u00f3n o posterior para proteger sus sistemas contra esta amenaza. Tambi\u00e9n se recomienda a los usuarios que roten los secretos de Google Cloud utilizados para las integraciones de BigQuery en sus implementaciones de Fides. No se conocen workarounds para esta vulnerabilidad."}], "id": "CVE-2024-35189", "lastModified": "2024-11-21T09:19:53.847", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2024-05-30T20:15:09.457", "references": [{"source": "security-advisories@github.com", "url": "https://cloud.google.com/iam/docs/key-rotation"}, {"source": "security-advisories@github.com", "url": "https://github.com/ethyca/fides/security/advisories/GHSA-rcvg-jj3g-rj7c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://cloud.google.com/iam/docs/key-rotation"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/ethyca/fides/security/advisories/GHSA-rcvg-jj3g-rj7c"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-201"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}