ethyca-fides (PyPI)
Advisories
44
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 2.84.5 or later clears every advisory below that has a fix.
Upgrade commands
pip
pip install --upgrade "ethyca-fides>=2.84.5"poetry
poetry add "ethyca-fides>=2.84.5"uv
uv add "ethyca-fides>=2.84.5"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-5qrq-9645-g5g2 ethyca-fides has a DOM-based XSS vulnerability in fides.js via fides_description override |
High EPSS 0.30% |
>= 2.33.0, < 2.84.5 | 2.84.5 |
| GHSA-5qrq-9645-g5g2 ethyca-fides has a DOM-based XSS vulnerability in fides.js via fides_description override |
High EPSS 0.30% |
>= 2.33.0, < 2.84.5 | 2.84.5 |
| GHSA-qx5f-ghc2-7g5c Ethyca Fides has a Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection |
Medium EPSS 0.31% |
>= 2.75.0, < 2.83.2 | 2.83.2 |
| GHSA-qx5f-ghc2-7g5c Ethyca Fides has a Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection |
Medium EPSS 0.31% |
>= 2.75.0, < 2.83.2 | 2.83.2 |
| GHSA-hjfh-p8f5-24wr Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation |
High EPSS 0.42% |
< 2.69.1 | 2.69.1 |
| GHSA-hjfh-p8f5-24wr Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation |
High EPSS 0.42% |
< 2.69.1 | 2.69.1 |
| GHSA-fq34-xw6c-fphf Fides Webserver API Rate Limiting Vulnerability in Proxied Environments |
High EPSS 0.43% |
< 2.69.1 | 2.69.1 |
| GHSA-fq34-xw6c-fphf Fides Webserver API Rate Limiting Vulnerability in Proxied Environments |
High EPSS 0.43% |
< 2.69.1 | 2.69.1 |
| GHSA-7q62-r88r-j5gw Fides has a Lack of Brute-Force Protections on Authentication Endpoints |
Medium EPSS 0.29% |
< 2.69.1 | 2.69.1 |
| GHSA-7q62-r88r-j5gw Fides has a Lack of Brute-Force Protections on Authentication Endpoints |
Medium EPSS 0.29% |
< 2.69.1 | 2.69.1 |
| GHSA-rpw8-82v9-3q87 Fides' Admin UI User Password Change Does Not Invalidate Current Session |
Medium EPSS 0.30% |
< 2.69.1 | 2.69.1 |
| GHSA-rpw8-82v9-3q87 Fides' Admin UI User Password Change Does Not Invalidate Current Session |
Medium EPSS 0.30% |
< 2.69.1 | 2.69.1 |
| GHSA-v7vm-rhmg-8j2r Password Policy Bypass Vulnerability in Fides Webserver User Accept Invite API |
High EPSS 0.56% |
< 2.50.0 | 2.50.0 |
| GHSA-v7vm-rhmg-8j2r Password Policy Bypass Vulnerability in Fides Webserver User Accept Invite API |
High EPSS 0.56% |
< 2.50.0 | 2.50.0 |
| GHSA-c34r-238x-f7qx Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine |
High EPSS 1.34% |
>= 2.19.0, < 2.44.0 | 2.44.0 |
| GHSA-c34r-238x-f7qx Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine |
High EPSS 1.34% |
>= 2.19.0, < 2.44.0 | 2.44.0 |
| GHSA-2h46-8gf5-fmxv Timing-Based Username Enumeration Vulnerability in Fides Webserver Authentication |
Medium EPSS 0.56% |
< 2.44.0 | 2.44.0 |
| GHSA-2h46-8gf5-fmxv Timing-Based Username Enumeration Vulnerability in Fides Webserver Authentication |
Medium EPSS 0.56% |
< 2.44.0 | 2.44.0 |
| GHSA-53q7-4874-24qg Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URL |
Medium EPSS 1.10% |
>= 2.19.0, < 2.39.2 | 2.39.2 |
| GHSA-53q7-4874-24qg Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URL |
Medium EPSS 1.10% |
>= 2.19.0, < 2.39.2 | 2.39.2 |
| GHSA-cvw4-c69g-7v7m Inclusion of Untrusted polyfill.io Code Vulnerability in fides.js |
Critical EPSS 1.43% |
< 2.39.1 | 2.39.1 |
| GHSA-cvw4-c69g-7v7m Inclusion of Untrusted polyfill.io Code Vulnerability in fides.js |
Critical EPSS 1.43% |
< 2.39.1 | 2.39.1 |
| GHSA-rcvg-jj3g-rj7c Sensitive Data Disclosure Vulnerability in Connection Configuration Endpoints |
Medium EPSS 0.58% |
< 2.37.0 | 2.37.0 |
| GHSA-rcvg-jj3g-rj7c Sensitive Data Disclosure Vulnerability in Connection Configuration Endpoints |
Medium EPSS 0.58% |
< 2.37.0 | 2.37.0 |
| GHSA-8cm5-jfj2-26q7 Fides Webserver Logs Hosted Database Password Partial Exposure Vulnerability |
Low EPSS 0.27% |
< 2.37.0 | 2.37.0 |
| GHSA-8cm5-jfj2-26q7 Fides Webserver Logs Hosted Database Password Partial Exposure Vulnerability |
Low EPSS 0.27% |
< 2.37.0 | 2.37.0 |
| GHSA-82vr-5769-6358 Ethyca Fides Cryptographically Weak Generation of One-Time Codes for Identity Verification |
Critical EPSS 0.99% |
< 2.24.0 | 2.24.0 |
| GHSA-82vr-5769-6358 Ethyca Fides Cryptographically Weak Generation of One-Time Codes for Identity Verification |
Critical EPSS 0.99% |
< 2.24.0 | 2.24.0 |
| GHSA-3vpf-mcj7-5h38 Ethyca Fides HTML Injection Vulnerability in HTML-Formatted DSR Packages |
Medium EPSS 0.61% |
>= 2.15.1, < 2.23.3 | 2.23.3 |
| GHSA-3vpf-mcj7-5h38 Ethyca Fides HTML Injection Vulnerability in HTML-Formatted DSR Packages |
Medium EPSS 0.61% |
>= 2.15.1, < 2.23.3 | 2.23.3 |
| GHSA-fgjj-5jmr-gh83 Fides JavaScript Injection Vulnerability in Privacy Center URL |
Medium EPSS 0.67% |
< 2.22.1 | 2.22.1 |
| GHSA-fgjj-5jmr-gh83 Fides JavaScript Injection Vulnerability in Privacy Center URL |
Medium EPSS 0.67% |
< 2.22.1 | 2.22.1 |
| GHSA-rjxg-rpg3-9r89 Fides Information Disclosure Vulnerability in Config API Endpoint |
Medium EPSS 0.92% |
< 2.22.1 | 2.22.1 |
| GHSA-rjxg-rpg3-9r89 Fides Information Disclosure Vulnerability in Config API Endpoint |
Medium EPSS 0.92% |
< 2.22.1 | 2.22.1 |
| GHSA-jq3w-9mgf-43m4 Fides Server-Side Request Forgery Vulnerability in Custom Integration Upload |
High EPSS 0.84% |
< 2.22.1 | 2.22.1 |
| GHSA-jq3w-9mgf-43m4 Fides Server-Side Request Forgery Vulnerability in Custom Integration Upload |
High EPSS 0.84% |
< 2.22.1 | 2.22.1 |
| GHSA-p6p2-qq95-vq5h Remote Code Execution in Custom Integration Upload |
High EPSS 0.94% |
>= 2.11.0, < 2.19.0 | 2.19.0 |
| GHSA-p6p2-qq95-vq5h Remote Code Execution in Custom Integration Upload |
High EPSS 0.94% |
>= 2.11.0, < 2.19.0 | 2.19.0 |
| GHSA-3rw2-wfc8-wmj5 Fides Webserver Vulnerable to SVG Bomb File Uploads |
Low EPSS 0.70% |
>= 2.11.0, < 2.16.0 | 2.16.0 |
| GHSA-3rw2-wfc8-wmj5 Fides Webserver Vulnerable to SVG Bomb File Uploads |
Low EPSS 0.70% |
>= 2.11.0, < 2.16.0 | 2.16.0 |
| GHSA-g95c-2jgm-hqc6 Fides Webserver Vulnerable to Zip Bomb File Uploads |
Low EPSS 0.69% |
>= 2.11.0, < 2.16.0 | 2.16.0 |
| GHSA-g95c-2jgm-hqc6 Fides Webserver Vulnerable to Zip Bomb File Uploads |
Low EPSS 0.69% |
>= 2.11.0, < 2.16.0 | 2.16.0 |
| GHSA-r25m-cr6v-p9hq ethyca-fides Webserver API Path Traversal vulnerability |
High EPSS 1.49% |
< 2.15.1 | 2.15.1 |
| GHSA-r25m-cr6v-p9hq ethyca-fides Webserver API Path Traversal vulnerability |
High EPSS 1.49% |
< 2.15.1 | 2.15.1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor