Digest · Sunday
Security digest: January 21, 2024
5 critical advisories.
All digests · RSS · Markdown
Take stock
- PyPI: 4 critical advisories (
embedchain,pandasai,llama-index,llama-hub). Check withpip-audit (or: pip show <package>). - Maven: 1 critical advisory (
org.clojure:clojure). Check withmvn dependency:tree -Dincludes=<groupId>:<artifactId>. - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 0
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
None.
Critical advisories by ecosystem 5
GitHub-reviewed advisories rated critical, published this day (Pacific time).
PyPI 4
Check: pip-audit (or: pip show <package>)
- Code execution in Embedchain CVE-2024-23731 CVSS 9.8 Critical
embedchain< 0.1.57 → fixed in 0.1.57 - Code execution in pandasai CVE-2024-23752 CVSS 9.8 Critical
pandasai<= 1.5.17 → no fix listed - SQL injection in llama-index CVE-2024-23751 CVSS 9.8 Critical
llama-index<= 0.9.35 → no fix listed - Unsafe yaml deserialization in llama-hub CVE-2024-23730 CVSS 9.8 Critical
llama-hub< 0.0.67 → fixed in 0.0.67
Maven 1
Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>
- Clojure classes can be used to craft a serialized object that runs arbitrary code on deserialization CVE-2017-20189 CVSS 9.8 Critical
org.clojure:clojure< 1.9.0 → fixed in 1.9.0