Digest · Friday
Security digest: October 20, 2023
2 critical advisories.
All digests · RSS · Markdown
Take stock
- PyPI: 2 critical advisories (
modoboa,langchain). Check withpip-audit (or: pip show <package>). - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 0
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
None.
Critical advisories by ecosystem 2
GitHub-reviewed advisories rated critical, published this day (Pacific time).
PyPI 2
Check: pip-audit (or: pip show <package>)
- modoboa Cross-site Scripting vulnerability CVE-2023-5688 CVSS 9.3 Critical
modoboa< 2.2.2 → fixed in 2.2.2 - Langchain SQL Injection vulnerability CVE-2023-32785 CVSS 9.8 Critical
langchain< 0.0.247 → fixed in 0.0.247