GHSA-82vr-5769-6358 CVE-2023-48224 PYSEC-2026-1336
Ethyca Fides Cryptographically Weak Generation of One-Time Codes for Identity Verification
- Severity
- 8.2 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- 0.99%
- Chance of exploitation in the next 30 days. Higher than 62.58% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
- Fix
2.24.0- Upgrade ethyca-fides to this version or later
Description
Impact
The Fides Privacy Center allows data subject users to submit privacy and consent requests to data controller users of the Fides web application.
Privacy requests allow data subjects to submit a request to access all person data held by the data controller, or delete/erase it. Consent request allows data subject users to modify their privacy preferences for how the data controller uses their personal data e.g. data sales and sharing consent opt-in/opt-out.
If subject_identity_verification_required in the [execution] section of fides.toml or the env var FIDES__EXECUTION__SUBJECT_IDENTITY_VERIFICATION_REQUIRED is set to True on the fides webserver backend, data subjects are sent a one-time code to their email address or phone number, depending on messaging configuration, and the one-time code must be entered in the Privacy Center UI by the data subject before the privacy or consent request is submitted.
It was identified that the one-time code values for these requests were generated by the python random module, a cryptographically weak pseduo-random number generator (PNRG). If an attacker generates several hundred consecutive one-time codes, this vulnerability allows the attacker to predict all future one-time code values during the lifetime of the backend python process.
There is no security impact on data access requests as the personal data download package is not shared in the Privacy Center itself. However, this vulnerability allows an attacker to (i) submit a verified data erasure request, resulting in deletion of data for the targeted user and (ii) submit a verified consent request, modifying a user's privacy preferences.
Patches
The vulnerability has been patched in Fides version 2.24.0. Users are advised to upgrade to this version or later to secure their systems against this threat.
Workarounds
None
References
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| ethyca-fides | < 2.24.0 |
2.24.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
ethyca-fides PyPI → 2.24.0
- pip
pip install --upgrade "ethyca-fides>=2.24.0"- poetry
poetry add "ethyca-fides>=2.24.0"- uv
uv add "ethyca-fides>=2.24.0"
Severity breakdown
CVSS 3.1 8.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- Low
- Availability
- High
Weakness
CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
How to prevent it
- Implementation: Use functions or hardware which use a hardware-based random number generation for all crypto. This is the recommended solution. Use CyptGenRandom on Windows, or hw_rand() on Linux.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-5qrq-9645-g5g2 ethyca-fides has a DOM-based XSS vulnerability in fides.js via fides_description override | High | Also affects ethyca-fides |
| GHSA-qx5f-ghc2-7g5c Ethyca Fides has a Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection | Medium | Also affects ethyca-fides |
| GHSA-hjfh-p8f5-24wr Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation | High | Also affects ethyca-fides |
| GHSA-fq34-xw6c-fphf Fides Webserver API Rate Limiting Vulnerability in Proxied Environments | High | Also affects ethyca-fides |
| GHSA-7q62-r88r-j5gw Fides has a Lack of Brute-Force Protections on Authentication Endpoints | Medium | Also affects ethyca-fides |
| GHSA-rpw8-82v9-3q87 Fides' Admin UI User Password Change Does Not Invalidate Current Session | Medium | Also affects ethyca-fides |
| GHSA-v7vm-rhmg-8j2r Password Policy Bypass Vulnerability in Fides Webserver User Accept Invite API | High | Also affects ethyca-fides |
| GHSA-c34r-238x-f7qx Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine | High | Also affects ethyca-fides |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor