Detections
Analytics

SCA: security update for ethyca-fides (GHSA-p6p2-qq95-vq5h)

high Tenable Cloud Security Plugin ID 417346

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests
 in a runtime environment, and the enforcement of privacy regulations in code. The Fides webserver API
 allows custom integrations to be uploaded as a ZIP file. This ZIP file must contain YAML files, but Fides
 can be configured to also accept the inclusion of custom Python code in it. The custom code is executed in
 a restricted, sandboxed environment, but the sandbox can be bypassed to execute any arbitrary code. The
 vulnerability allows the execution of arbitrary code on the target system within the context of the
 webserver python process owner on the webserver container, which by default is `root`, and leverage that
 access to attack underlying infrastructure and integrated systems. This vulnerability affects Fides
 versions `2.11.0` through `2.19.0`. Exploitation is limited to API clients with the
 `CONNECTOR_TEMPLATE_REGISTER` authorization scope. In the Fides Admin UI this scope is restricted to
 highly privileged users, specifically root users and users with the owner role. Exploitation is only
 possible if the security configuration parameter `allow_custom_connector_functions` is enabled by the user
 deploying the Fides webserver container, either in `fides.toml` or by setting the env var
 `FIDES__SECURITY__ALLOW_CUSTOM_CONNECTOR_FUNCTIONS=True`. By default this configuration parameter is
 disabled. The vulnerability has been patched in Fides version `2.19.0`. Users are advised to upgrade to
 this version or later to secure their systems against this threat. Users unable to upgrade should ensure
 that `allow_custom_connector_functions` in `fides.toml` and the
 `FIDES__SECURITY__ALLOW_CUSTOM_CONNECTOR_FUNCTIONS` are both either unset or explicit set to `False`.
 (CVE-2023-41319)

See Also

https://github.com/advisories/GHSA-p6p2-qq95-vq5h

Plugin Details

Severity: High

ID: 417346

Version: Revision 1.9

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.58

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 8.3

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:C

CVSS Score Source: CVE-2023-41319

CVSS v3

Risk Factor: High

Base Score: 7.2

Temporal Score: 6.3

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/7/2023

Vulnerability Publication Date: 9/6/2023

Reference Information

CVE: CVE-2023-41319

cwe: CWE-693