CVE-2024-34715

Advisory

Fides is an open-source privacy engineering platform. The Fides webserver requires a connection to a hosted PostgreSQL database for persistent storage of application data. If the password used by the web server for this database connection includes special characters such as `@` and `$`, the webserver startup fails and the part of the password following the special character is exposed in web server error logs. This is caused by improper escaping of the SQLAlchemy password string. As a result, users are subject to partial exposure of hosted database passwords in web server logs.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/ethyca/fides/commit/6ab37b1ffe2b1a3bd35b706a82f78e061086141c
• https://github.com/advisories/GHSA-8cm5-jfj2-26q7
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-34715