erroneo.us
Search all guides⌘K

Digest · Wednesday

Security digest: January 24, 2024

1 editorial brief, 1 known exploited (cisa kev) addition and 1 critical advisory.

All digests · RSS · Markdown

Take stock

  • Act now: Jenkins CLI Arbitrary File Read (CVE-2024-23897). Operators of Jenkins weekly 2.441 or earlier or LTS 2.426.2 or earlier, especially controllers reachable from the internet or with anonymous read or open signup.
  • Do you run any of these? Atlassian Confluence Data Center and Server. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2024-02-14.
  • Maven: 1 critical advisory (org.jenkins-ci.main:jenkins-core). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

· Vulnerability · CVE-2024-23897, CVE-2024-23898

Jenkins CLI Arbitrary File Read (CVE-2024-23897)

An unpatched Jenkins controller reachable by untrusted users leaks files and secrets that can lead to full takeover; upgrade now or disable the CLI.

Must act: Operators of Jenkins weekly 2.441 or earlier or LTS 2.426.2 or earlier, especially controllers reachable from the internet or with anonymous read or open signup.

Can relax: Teams already on Jenkins 2.442+ or LTS 2.426.3+ (or any current release), and users of hosted CI systems that are not Jenkins.

  1. Check the version shown in the Jenkins web UI footer and upgrade to a current weekly or LTS release.
  2. If you cannot upgrade today, apply the advisory's workaround to disable CLI access; it needs no restart.
  3. Remove anonymous read access and disable self-signup unless you truly need them.

Read the brief →

Known exploited (CISA KEV) 1

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2023-22527Atlassian Confluence Data Center and Server
Atlassian Confluence Data Center and Server Template Injection Vulnerability Ransomware		2024-02-14

Critical advisories by ecosystem 1

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Maven 1

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>