{"answers":{"affected":"3 open source packages ship an affected version, including ethyca-fides. It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-35189 exists.","fix":"Upgrade ethyca-fides to 2.37.0 or later.","what":"CVE-2024-35189 is a medium-severity vulnerability in ethyca fides, published on 30 May 2024. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-35189 and fix it if it is affected.\n\nWhat it is: CVE-2024-35189 is a medium-severity vulnerability in ethyca fides, published on 30 May 2024. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-35189 exists.\n\nAffected packages and fixed versions:\n- ethyca-fides (PyPI): affected all versions; fixed in 2.37.0\n- ethyca-fides (PyPI): affected all versions; fixed in 2.37.0\n- ethyca-fides (PyPI): affected all versions; fixed in 2.37.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-35189/ (Markdown: https://insights.sbomify.com/CVE-2024-35189/index.md)","id":"CVE-2024-35189","markdown":"https://insights.sbomify.com/CVE-2024-35189/index.md","name":"CVE-2024-35189","record":{"aliases":["GHSA-rcvg-jj3g-rj7c","PYSEC-2026-1346"],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Privacy engineering platform","requires_auth":"low_privilege","summary":"Attackers can retrieve unmasked BigQuery private keys from API endpoints due to a masking bug in Fides, exposing sensitive cloud credentials.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"fides","vendor":"ethyca"}],"cvss":{"score":6.5,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-201","name":"Insertion of Sensitive Information Into Sent Data"},{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"description":"Fides is an open-source privacy engineering platform. The Fides webserver has a number of endpoints that retrieve `ConnectionConfiguration` records and their associated `secrets` which _can_ contain sensitive data (e.g. passwords, private keys, etc.). These `secrets` are stored encrypted at rest (in the application database), and the associated endpoints are not meant to expose that sensitive data in plaintext to API clients, as it could be compromising. Fides's developers have available to them a Pydantic field-attribute (`sensitive`) that they can annotate as `True` to indicate that a given secret field should not be exposed via the API. The application has an internal function that uses `sensitive` annotations to mask the sensitive fields with a `\"**********\"` placeholder value. This vulnerability is due to a bug in that function, which prevented `sensitive` API model fields that were _nested_ below the root-level of a `secrets` object from being masked appropriately. Only the `BigQuery` connection configuration secrets meets these criteria: the secrets schema has a nested sensitive `keyfile_creds.private_key` property that is exposed in plaintext via the APIs. Connection types other than `BigQuery` with sensitive fields at the root-level that are not nested are properly masked with the placeholder and are not affected by this vulnerability. This vulnerability has been patched in Fides version 2.37.0. Users are advised to upgrade to this version or later to secure their systems against this threat. Users are also advised to rotate any Google Cloud secrets used for BigQuery integrations in their Fides deployments. There are no known workarounds for this vulnerability.","ecosystems":["PyPI"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"Sensitive Data Disclosure Vulnerability in Connection Configuration Endpoints in Fides","id":"CVE-2024-35189","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"information_disclosure","year":"2024"},"n_packages":3,"n_references":2,"next":{"headline":"Asterisk' res_pjsip_endpoint_identifier_ip: wrongly matches ALL unauthorized SIP requests","id":"CVE-2024-35190"},"packages":[{"ecosystem":"PyPI","fixed":["2.37.0"],"introduced":["0"],"last_affected":[],"package":"ethyca-fides","purl":null,"source":"GHSA-rcvg-jj3g-rj7c"},{"ecosystem":"PyPI","fixed":["2.37.0"],"introduced":["0"],"last_affected":[],"package":"ethyca-fides","purl":"pkg:pypi/ethyca-fides","source":"GHSA-rcvg-jj3g-rj7c"},{"ecosystem":"PyPI","fixed":["2.37.0"],"introduced":["0"],"last_affected":[],"package":"ethyca-fides","purl":"pkg:pypi/ethyca-fides","source":"PYSEC-2026-1346"}],"prev":{"headline":"Stalwart Mail Server has privilege escalation by design","id":"CVE-2024-35187"},"products":["fides"],"published":"2024-05-30","related":[{"cvss_score":9.1,"headline":"Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine","id":"CVE-2024-45053","kev_date_added":null,"published":"2024-09-04"},{"cvss_score":8.8,"headline":"Remote Code Execution in Custom Integration Upload in Fides","id":"CVE-2023-41319","kev_date_added":null,"published":"2023-09-06"},{"cvss_score":8.6,"headline":"Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation","id":"CVE-2025-57817","kev_date_added":null,"published":"2025-09-08"},{"cvss_score":8.2,"headline":"Cryptographically Weak Generation of One-Time Codes for Identity Verification in ethyca-fides","id":"CVE-2023-48224","kev_date_added":null,"published":"2023-11-15"},{"cvss_score":8.2,"headline":"Server-Side Request Forgery Vulnerability in Custom Integration Upload","id":"CVE-2023-46124","kev_date_added":null,"published":"2023-10-24"},{"cvss_score":7.5,"headline":"Fides vulnerable to Path Traversal in Webserver API","id":"CVE-2023-36827","kev_date_added":null,"published":"2023-07-05"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"PyPA Advisory Database","prefix":"PYSEC"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2024-08-02","vendors":["ethyca"]},"summary":"Attackers can retrieve unmasked BigQuery private keys from API endpoints due to a masking bug in Fides, exposing sensitive cloud credentials.","url":"https://insights.sbomify.com/CVE-2024-35189/"}