Digest · Wednesday

Security digest: February 7, 2024

3 critical advisories.

Take stock

PyPI: 2 critical advisories (Products.SQLAlchemyDA, vyper). Check with pip-audit (or: pip show <package>).
Maven: 1 critical advisory (com.liferay.portal:release.portal.bom, com.liferay.portal:release.dxp.bom). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Check: pip-audit (or: pip show <package>)

SQLAlchemyDA unauthenticated arbitrary SQL query execution CVE-2024-24811 CVSS 9.8 Critical
Products.SQLAlchemyDA < 2.2 → fixed in 2.2
Vyper negative array index bounds checks CVE-2024-24563 CVSS 9.8 Critical
vyper < 0.4.0 → fixed in 0.4.0

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

Liferay Portal stored cross-site scripting (XSS) vulnerability CVE-2024-25145 CVSS 9.6 Critical
com.liferay.portal:release.portal.bom < 7.4.3.12 → fixed in 7.4.3.12; com.liferay.portal:release.dxp.bom >= 7.4.0, < 7.4.3.13u8 → fixed in 7.4.3.13u8; com.liferay.portal:release.dxp.bom >= 7.3.0, < 7.3.10.u4 → fixed in 7.3.10.u4; +1 more packages