--- title: "Security digest: November 20, 2023" url: https://erroneo.us/security/2023-11-20/ description: "November 20, 2023 vulnerability digest: 4 critical advisories (Maven, PyPI). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2023-11-20 date_modified: 2023-11-20 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: November 20, 2023 4 critical advisories. ## Take stock - Maven: 3 critical advisories ( org.apache.derby:derby , org.xwiki.contrib:xwiki-application-admintools , org.xwiki.platform:xwiki-platform-diff-xml ). Check with mvn dependency:tree -Dincludes=: . - PyPI: 1 critical advisory ( apache-submarine ). Check with pip-audit (or: pip show ) . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) None. ## Critical advisories - [CVE-2022-46337](https://erroneo.us/security/cve/CVE-2022-46337/index.md) Apache Derby: LDAP injection vulnerability in authenticator — Maven org.apache.derby:derby >= 10.1.1.0, <= 10.1.3.1 → no fix; Maven org.apache.derby:derby >= 10.2.1.6, <= 10.2.2.0 → no fix; Maven org.apache.derby:derby >= 10.3.1.4, <= 10.3.3.0 → no fix - [CVE-2023-48292](https://erroneo.us/security/cve/CVE-2023-48292/index.md) Run Shell Command allows Cross-Site Request Forgery — Maven org.xwiki.contrib:xwiki-application-admintools >= 4.4, < 4.5.1 → 4.5.1 - [CVE-2023-46302](https://erroneo.us/security/cve/CVE-2023-46302/index.md) Deserialization of Untrusted Data in apache-submarine — PyPI apache-submarine >= 0.7.0, < 0.8.0 → 0.8.0 - [CVE-2023-48240](https://erroneo.us/security/cve/CVE-2023-48240/index.md) Cookies are sent to external images in rendered diff (and server side request forgery) — Maven org.xwiki.platform:xwiki-platform-diff-xml >= 11.10.1, < 14.10.15 → 14.10.15; Maven org.xwiki.platform:xwiki-platform-diff-xml >= 15.0-rc-1, < 15.5.1 → 15.5.1; Maven org.xwiki.platform:xwiki-platform-diff-xml >= 15.6-rc-1, < 15.6 → 15.6 --- Source page: https://erroneo.us/security/2023-11-20/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt