Digest · Friday
Security digest: November 24, 2023
2 critical advisories.
All digests · RSS · Markdown
Take stock
- Go: 2 critical advisories (
github.com/projectcapsule/capsule-proxy,github.com/clastix/capsule-proxy,github.com/layer5io/meshery). Check withgovulncheck ./.... - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 0
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
None.
Critical advisories by ecosystem 2
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Go 2
Check: govulncheck ./...
- Capsule Proxy Authentication bypass using an empty token CVE-2023-48312 CVSS 9.8 Critical
github.com/projectcapsule/capsule-proxy<= 0.4.5 → fixed in 0.4.6;github.com/clastix/capsule-proxy<= 0.4.5 → fixed in 0.4.6 - SQL injection vulnerability in Meshery CVE-2023-46575 CVSS 9.1 Critical
github.com/layer5io/meshery< 0.6.179 → fixed in 0.6.179