--- title: "Security digest: December 4, 2023" url: https://erroneo.us/security/2023-12-04/ description: "December 4, 2023 vulnerability digest: 2 CISA KEV additions (Apple); 3 critical advisories (Maven). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2023-12-04 date_modified: 2023-12-04 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: December 4, 2023 2 known exploited (cisa kev) additions and 3 critical advisories. ## Take stock - Do you run any of these? Apple Multiple Products. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2023-12-25. - Maven: 3 critical advisories ( org.noear:solon , io.github.microcks:microcks , org.htmlunit:htmlunit ). Check with mvn dependency:tree -Dincludes=: . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) - [CVE-2023-42917](https://erroneo.us/security/cve/CVE-2023-42917/index.md) Apple Multiple Products: Apple Multiple Products WebKit Memory Corruption Vulnerability (CISA due 2023-12-25) - [CVE-2023-42916](https://erroneo.us/security/cve/CVE-2023-42916/index.md) Apple Multiple Products: Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability (CISA due 2023-12-25) ## Critical advisories - [CVE-2023-48967](https://erroneo.us/security/cve/CVE-2023-48967/index.md) Solon is vulnerable to Deserialization of Untrusted Data — Maven org.noear:solon <= 2.6.0 → no fix - [CVE-2023-48910](https://erroneo.us/security/cve/CVE-2023-48910/index.md) Microcks contains a Server-Side Request Forgery (SSRF) via the component /jobs and /artifact/download — Maven io.github.microcks:microcks < 1.17.1 → 1.17.1 - [CVE-2023-49093](https://erroneo.us/security/cve/CVE-2023-49093/index.md) HtmlUnit vulnerable to Remote Code Execution (RCE) via XSTL — Maven org.htmlunit:htmlunit < 3.9.0 → 3.9.0 --- Source page: https://erroneo.us/security/2023-12-04/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt