Advisory Published


First published: Thu Nov 16 2023(Updated: )

### Impact The Fides Privacy Center allows data subject users to submit privacy and consent requests to data controller users of the Fides web application. Privacy requests allow data subjects to submit a request to access all person data held by the data controller, or delete/erase it. Consent request allows data subject users to modify their privacy preferences for how the data controller uses their personal data e.g. data sales and sharing consent opt-in/opt-out. If `subject_identity_verification_required` in the `[execution]` section of `fides.toml` or the env var `FIDES__EXECUTION__SUBJECT_IDENTITY_VERIFICATION_REQUIRED` is set to `True` on the fides webserver backend, data subjects are sent a one-time code to their email address or phone number, depending on messaging configuration, and the one-time code must be entered in the Privacy Center UI by the data subject before the privacy or consent request is submitted. It was identified that the one-time code values for these requests were generated by the python `random` module, a cryptographically weak pseduo-random number generator (PNRG). If an attacker generates several hundred consecutive one-time codes, this vulnerability allows the attacker to predict all future one-time code values during the lifetime of the backend python process. There is no security impact on data access requests as the personal data download package is not shared in the Privacy Center itself. However, this vulnerability allows an attacker to (i) submit a verified data erasure request, resulting in deletion of data for the targeted user and (ii) submit a verified consent request, modifying a user's privacy preferences. ### Patches The vulnerability has been patched in Fides version `2.24.0`. Users are advised to upgrade to this version or later to secure their systems against this threat. ### Workarounds None ### References * https://peps.python.org/pep-0506/

Affected SoftwareAffected VersionHow to fix

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Frequently Asked Questions

  • What is the impact of GHSA-82vr-5769-6358?

    The vulnerability allows data subject users to submit privacy and consent requests to data controller users of the Fides web application.

  • How does GHSA-82vr-5769-6358 affect the Fides Privacy Center?

    GHSA-82vr-5769-6358 affects the Fides Privacy Center by allowing data subject users to submit privacy and consent requests.

  • What can data subjects do with GHSA-82vr-5769-6358?

    Data subjects can use GHSA-82vr-5769-6358 to request access to their personal data held by the data controller or request its deletion.

  • Which version of ethyca-fides is affected by GHSA-82vr-5769-6358?

    Version 2.24.0 of ethyca-fides is affected by GHSA-82vr-5769-6358.

  • How can I fix GHSA-82vr-5769-6358 in my Fides installation?

    To fix GHSA-82vr-5769-6358, update the ethyca-fides package to version 2.24.0 or higher.


SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2023 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203