Detections
Analytics
SCA: security update for ethyca-fides (GHSA-rcvg-jj3g-rj7c)
medium Tenable Self-Hosted Container Security Plugin ID 418674
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Fides is an open-source privacy engineering platform. The Fides webserver has a number of endpoints that
retrieve `ConnectionConfiguration` records and their associated `secrets` which _can_ contain sensitive
data (e.g. passwords, private keys, etc.). These `secrets` are stored encrypted at rest (in the
application database), and the associated endpoints are not meant to expose that sensitive data in
plaintext to API clients, as it could be compromising. Fides's developers have available to them a
Pydantic field-attribute (`sensitive`) that they can annotate as `True` to indicate that a given secret
field should not be exposed via the API. The application has an internal function that uses `sensitive`
annotations to mask the sensitive fields with a `"**********"` placeholder value. This vulnerability is
due to a bug in that function, which prevented `sensitive` API model fields that were _nested_ below the
root-level of a `secrets` object from being masked appropriately. Only the `BigQuery` connection
configuration secrets meets these criteria: the secrets schema has a nested sensitive
`keyfile_creds.private_key` property that is exposed in plaintext via the APIs. Connection types other
than `BigQuery` with sensitive fields at the root-level that are not nested are properly masked with the
placeholder and are not affected by this vulnerability. This vulnerability has been patched in Fides
version 2.37.0. Users are advised to upgrade to this version or later to secure their systems against this
threat. Users are also advised to rotate any Google Cloud secrets used for BigQuery integrations in their
Fides deployments. There are no known workarounds for this vulnerability. (CVE-2024-35189)
See Also
Plugin Details
Severity: Medium
ID: 418674
Version: Revision 1.9
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.51
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5.3
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:N
CVSS Score Source: CVE-2024-35189
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.9
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 6/2/2024
Vulnerability Publication Date: 5/30/2024
Reference Information
CVE: CVE-2024-35189
cwe: CWE-200