Digest · Monday

Security digest: November 20, 2023

4 critical advisories.

Take stock

Maven: 3 critical advisories (org.apache.derby:derby, org.xwiki.contrib:xwiki-application-admintools, org.xwiki.platform:xwiki-platform-diff-xml). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
PyPI: 1 critical advisory (apache-submarine). Check with pip-audit (or: pip show <package>).
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

Apache Derby: LDAP injection vulnerability in authenticator CVE-2022-46337 CVSS 9.8 Critical
org.apache.derby:derby >= 10.1.1.0, <= 10.1.3.1 → no fix listed; org.apache.derby:derby >= 10.2.1.6, <= 10.2.2.0 → no fix listed; org.apache.derby:derby >= 10.3.1.4, <= 10.3.3.0 → no fix listed; +13 more packages
Run Shell Command allows Cross-Site Request Forgery CVE-2023-48292 CVSS 9.6 Critical
org.xwiki.contrib:xwiki-application-admintools >= 4.4, < 4.5.1 → fixed in 4.5.1
Cookies are sent to external images in rendered diff (and server side request forgery) CVE-2023-48240 CVSS 9.0 Critical
org.xwiki.platform:xwiki-platform-diff-xml >= 11.10.1, < 14.10.15 → fixed in 14.10.15; org.xwiki.platform:xwiki-platform-diff-xml >= 15.0-rc-1, < 15.5.1 → fixed in 15.5.1; org.xwiki.platform:xwiki-platform-diff-xml >= 15.6-rc-1, < 15.6 → fixed in 15.6

Check: pip-audit (or: pip show <package>)

Deserialization of Untrusted Data in apache-submarine CVE-2023-46302 CVSS 9.8 Critical
apache-submarine >= 0.7.0, < 0.8.0 → fixed in 0.8.0