CVE-2023-48224: Cryptographically Weak Generation of One-Time Codes for Identity Verification in ethyca-fides
First published: Wed Nov 15 2023(Updated: )
### Impact The Fides Privacy Center allows data subject users to submit privacy and consent requests to data controller users of the Fides web application. Privacy requests allow data subjects to submit a request to access all person data held by the data controller, or delete/erase it. Consent request allows data subject users to modify their privacy preferences for how the data controller uses their personal data e.g. data sales and sharing consent opt-in/opt-out. If `subject_identity_verification_required` in the `[execution]` section of `fides.toml` or the env var `FIDES__EXECUTION__SUBJECT_IDENTITY_VERIFICATION_REQUIRED` is set to `True` on the fides webserver backend, data subjects are sent a one-time code to their email address or phone number, depending on messaging configuration, and the one-time code must be entered in the Privacy Center UI by the data subject before the privacy or consent request is submitted. It was identified that the one-time code values for these requests were generated by the python `random` module, a cryptographically weak pseduo-random number generator (PNRG). If an attacker generates several hundred consecutive one-time codes, this vulnerability allows the attacker to predict all future one-time code values during the lifetime of the backend python process. There is no security impact on data access requests as the personal data download package is not shared in the Privacy Center itself. However, this vulnerability allows an attacker to (i) submit a verified data erasure request, resulting in deletion of data for the targeted user and (ii) submit a verified consent request, modifying a user's privacy preferences. ### Patches The vulnerability has been patched in Fides version `2.24.0`. Users are advised to upgrade to this version or later to secure their systems against this threat. ### Workarounds None ### References * https://peps.python.org/pep-0506/
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pip/ethyca-fides | <2.24.0 | 2.24.0 |
| Ethyca Fides | <2.24.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for the Cryptographically Weak Generation of One-Time Codes in ethyca-fides?
The vulnerability ID is CVE-2023-48224.
What is ethyca-fides and what does it do?
ethyca-fides is an open-source privacy engineering platform for managing data privacy requests and enforcing privacy regulations in code.
What is the severity rating of CVE-2023-48224?
The severity rating of the vulnerability is high, with a value of 8.2.
How does CVE-2023-48224 affect ethyca-fides?
CVE-2023-48224 affects the generation of one-time codes for identity verification in ethyca-fides, potentially compromising the security of the verification process.
How can I mitigate the vulnerability in ethyca-fides?
To mitigate the vulnerability, update ethyca-fides to version 2.24.0 or higher, as recommended by the remedy.
- collector/github-advisory-latest
- alias/GHSA-82vr-5769-6358
- alias/CVE-2023-48224
- collector/nvd-cve
- collector/github-advisory
- collector/nvd-api
- agent/author
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- agent/remedy
- agent/severity
- agent/title
- agent/references
- agent/weakness
- agent/event
- agent/description
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- package-manager/pip
- vendor/ethyca
- canonical/ethyca fides