Digest · Thursday
Security digest: December 14, 2023
4 critical advisories.
All digests · RSS · Markdown
Take stock
- PyPI: 3 critical advisories (
gradio,h2o,mlflow). Check withpip-audit (or: pip show <package>). - npm: 1 critical advisory (
@spscommerce/ds-react). Check withnpm audit (or: npm ls <package>). - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 0
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
None.
Critical advisories by ecosystem 4
GitHub-reviewed advisories rated critical, published this day (Pacific time).
PyPI 3
Check: pip-audit (or: pip show <package>)
- Gradio Exposure of Sensitive Information to an Unauthorized Actor vulnerability CVE-2023-6572 CVSS 9.6 Critical
gradio>= 0, < 4.14.0 → fixed in 4.14.0 - External Control of File Name or Path in h2oai/h2o-3 CVE-2023-6569 CVSS 9.3 Critical
h2o< 3.46.0.1 → fixed in 3.46.0.1 - Path traversal in MLflow CVE-2023-6831 CVSS 10.0 Critical
mlflow< 2.9.2 → fixed in 2.9.2
npm 1
Check: npm audit (or: npm ls <package>)
- Cross-site Scripting in @spscommerce/ds-react GHSA-cfxh-frx4-9gjg
@spscommerce/ds-react>= 4.12.2, < 7.17.4 → fixed in 7.17.4