{"id":"CVE-2024-34715","aliases":["GHSA-8cm5-jfj2-26q7","PYSEC-2026-1337"],"url":"https://o3.security/vulnerability/CVE-2024-34715","summary":"Partial Password Exposure Vulnerability in Fides Webserver Logs","details":"The Fides webserver requires a connection to a hosted PostgreSQL database for persistent storage of application data. If the password used by the webserver for this database connection includes special characters such as `@` and `$`, webserver startup fails and the part of the password following the special character is exposed in webserver error logs.\n\nThis is caused by improper escaping of the SQLAlchemy password string, see [here](https://docs.sqlalchemy.org/en/14/core/engines.html#escaping-special-characters-such-as-signs-in-passwords) and [here](https://github.com/sqlalchemy/sqlalchemy/discussions/6615) for more info.\n\n### Impact\nPartial exposure of hosted database password in webserver logs\n\n### Patches\nThe vulnerability has been patched in Fides version `2.37.0`. Users are advised to upgrade to this version or later to secure their systems against this threat.\n\n### Workarounds\nThere are no workarounds.\n\n### Proof of Concept\n1. Create a hosted PostgreSQL database for Fides with a password including `@` or `$` e.g. `p@ssword`\n2. Run Fides and observe failure, sample log attached\n\n```\nfides  | 2024-02-28 14:27:52.609 | ERROR    | fides.api.db.database:configure_db:117 - Unable to configure database: sqlalchemy.exc.OperationalError: (psycopg2.OperationalError) could not translate host name \"ssword@fides-db\" to address: Name or service not known\n```","published":"2024-05-29T16:35:46.375Z","modified":"2026-08-12T03:51:36.304590468Z","cvss":{"score":2.3,"severity":"LOW","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"ethyca-fides","fixedVersion":"2.37.0"}],"fix":{"url":"https://github.com/ethyca/fides/commit/6ab37b1ffe2b1a3bd35b706a82f78e061086141c","label":"ethyca/fides@6ab37b1"},"references":[{"type":"WEB","url":"https://docs.sqlalchemy.org/en/14/core/engines.html#escaping-special-characters-such-as-signs-in-passwords"},{"type":"WEB","url":"https://github.com/sqlalchemy/sqlalchemy/discussions/6615"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34715.json"},{"type":"ADVISORY","url":"https://github.com/ethyca/fides/security/advisories/GHSA-8cm5-jfj2-26q7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34715"},{"type":"FIX","url":"https://github.com/ethyca/fides/commit/6ab37b1ffe2b1a3bd35b706a82f78e061086141c"},{"type":"PACKAGE","url":"https://github.com/ethyca/fides"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:36.304590468Z"}}