---
title: "Security digest: November 16, 2023"
url: https://erroneo.us/security/2023-11-16/
description: "November 16, 2023 vulnerability digest: 3 CISA KEV additions (Microsoft, Oracle, Sophos); 8 critical advisories (Maven, PyPI). What to patch and who can…"
type: security-digest-day
section: "Security Digest"
date_published: 2023-11-16
date_modified: 2023-11-16
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: November 16, 2023

3 known exploited (cisa kev) additions and 8 critical advisories.

## Take stock

- Do you run any of these? Microsoft Windows, Sophos Web Appliance, Oracle Fusion Middleware. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2023-12-07.
- PyPI: 6 critical advisories ( ray , mlflow ). Check with pip-audit (or: pip show <package>) .
- Maven: 2 critical advisories ( com.liferay.portal:release.portal.bom , ai.h2o:h2o-core ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2023-36584](https://erroneo.us/security/cve/CVE-2023-36584/index.md) Microsoft Windows: Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability (CISA due 2023-12-07)
- [CVE-2023-1671](https://erroneo.us/security/cve/CVE-2023-1671/index.md) Sophos Web Appliance: Sophos Web Appliance Command Injection Vulnerability (CISA due 2023-12-07)
- [CVE-2020-2551](https://erroneo.us/security/cve/CVE-2020-2551/index.md) Oracle Fusion Middleware: Oracle Fusion Middleware Unspecified Vulnerability (CISA due 2023-12-07)

## Critical advisories

- [CVE-2023-47797](https://erroneo.us/security/cve/CVE-2023-47797/index.md) Liferay Portal XSS with `p_l_back_url_title` on edit content page — Maven com.liferay.portal:release.portal.bom >= 7.4.3.94, < 7.4.3.96 → 7.4.3.96
- [CVE-2023-6019](https://erroneo.us/security/cve/CVE-2023-6019/index.md) Ray OS Command Injection vulnerability — PyPI ray < 2.8.1 → 2.8.1
- [CVE-2023-6015](https://erroneo.us/security/cve/CVE-2023-6015/index.md) MLflow allowed arbitrary files to be PUT onto the server — PyPI mlflow < 2.8.1 → 2.8.1
- [CVE-2023-6038](https://erroneo.us/security/cve/CVE-2023-6038/index.md) H2O local file inclusion vulnerability — Maven ai.h2o:h2o-core <= 3.40.0.4 → no fix
- [CVE-2023-6020](https://erroneo.us/security/cve/CVE-2023-6020/index.md) Ray Missing Authorization vulnerability — PyPI ray < 2.8.1 → 2.8.1
- [CVE-2023-6018](https://erroneo.us/security/cve/CVE-2023-6018/index.md) Remote Code Execution due to Full Controled File Write in mlflow — PyPI mlflow <= 2.8.1 → 2.9.2
- [CVE-2023-6014](https://erroneo.us/security/cve/CVE-2023-6014/index.md) MLflow authentication requirement bypass can allow a user to arbitrarily create an account — PyPI mlflow < 2.8.0 → 2.8.0
- [CVE-2023-6021](https://erroneo.us/security/cve/CVE-2023-6021/index.md) Ray Path Traversal vulnerability — PyPI ray < 2.8.1 → 2.8.1

---
Source page: https://erroneo.us/security/2023-11-16/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt