p PatchFirst

CVE-2024-45053

CVE-2024-45053 · Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

Fides is an open-source privacy engineering platform. Starting in version 2.19.0 and prior to version 2.44.0, the Email Templating feature uses Jinja2 without proper input sanitization or rendering environment restrictions, allowing for Server-Side Template Injection that grants Remote Code Execution to privileged users. A privileged user refers to an Admin UI user with the default `Owner` or `Contributor` role, who can escalate their access and execute code on the underlying Fides Webserver container where the Jinja template rendering function is executed. The vulnerability has been patched in Fides version `2.44.0`. Users are advised to upgrade to this version or later to secure their systems against this threat. There are no workarounds.

CVSS 9.1 · Critique · EPSS 1,3% · Correctif disponible

Publication
Mise à jour

Pile logicielle: python

Produits et versions concernés

  • fides

    Versions du logiciel
    • >= 2.19.0, < 2.44.0: Concernée

    Aucun correctif publié

  • ethyca-fides PyPI

    Versions du logiciel
    • 2.19.0
    • 2.19.1
    • 2.20.0
    • 2.20.1
    • 2.20.2
    • 2.21.0
    • 2.22.0
    • 2.22.1
    • 2.23.0
    • 2.23.1
    • 2.23.2
    • 2.23.3
    • 2.24.0
    • 2.24.1
    • 2.25.0
    • 2.26.0
    • 2.26.3
    • 2.27.0
    • 2.28.0
    • 2.29.0
    • 2.30.0
    • 2.30.1
    • 2.31.0
    • 2.32.0
    • 2.33.0
    • 2.33.1
    • 2.34.0
    • 2.35.0
    • 2.35.1
    • 2.36.0
    • 2.37.0
    • 2.38.0
    • 2.38.1
    • 2.39.0
    • 2.39.1
    • 2.39.2
    • 2.40.0
    • 2.41.0
    • 2.42.0
    • 2.42.1
    • 2.43.0
    • 2.43.2
    Plages de versions concernées
    • ECOSYSTEM: ≥ 2.19.0, < 2.44.0

    Mettez à jour vers 2.44.0

Sources originales

Vérifiez votre serveur →