erroneo.us
Search all guides⌘K

Digest · Friday

Security digest: October 27, 2023

1 critical advisory.

All digests · RSS · Markdown

Take stock

  • Maven: 1 critical advisory (org.apache.activemq:activemq-client, org.apache.activemq:activemq-openwire-legacy). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 1

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Maven 1

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

  • Apache ActiveMQ is vulnerable to Remote Code Execution CVE-2023-46604 CVSS 10.0 Critical
    org.apache.activemq:activemq-client < 5.15.16 → fixed in 5.15.16; org.apache.activemq:activemq-client >= 5.16.0, < 5.16.7 → fixed in 5.16.7; org.apache.activemq:activemq-client >= 5.17.0, < 5.17.6 → fixed in 5.17.6; +5 more packages