Cryptographically Weak Generation of One-Time Codes for Identity Verification in ethyca-fides

CVE-2023-48224

What is CVE-2023-48224?

The Fides Privacy Center encounters a security vulnerability due to the use of the Python random module for generating one-time codes. When configured for identity verification, this implementation allows attackers to predict the codes generated during the session, which could lead to unauthorized data erasure or modification of a user’s privacy preferences. Specifically, if an attacker is able to generate and analyze several one-time codes, they can manipulate privacy and consent requests, which may impact the security of user data. It is crucial for users of the Fides platform to upgrade to version 2.24.0 or later to mitigate this issue, as there are no known workarounds available.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References