erroneo.us
Search all guides⌘K

Digest · Thursday

Security digest: February 8, 2024

1 editorial brief and 1 critical advisory.

All digests · RSS · Markdown

Take stock

  • Act now: FortiOS SSL VPN Pre-Auth RCE (CVE-2024-21762). Owners of FortiOS 6.0 through 7.4.2 or FortiProxy 1.0 through 7.4.2 devices with SSL VPN enabled, particularly where the VPN portal is internet-facing.
  • PyPI: 1 critical advisory (DIRAC, dirac). Check with pip-audit (or: pip show <package>).
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

· Vulnerability · CVE-2024-21762

FortiOS SSL VPN Pre-Auth RCE (CVE-2024-21762)

Any FortiGate or FortiProxy with SSL VPN enabled on an unfixed build is exposed to unauthenticated remote code execution that has been exploited; upgrade or disable SSL VPN today.

Must act: Owners of FortiOS 6.0 through 7.4.2 or FortiProxy 1.0 through 7.4.2 devices with SSL VPN enabled, particularly where the VPN portal is internet-facing.

Can relax: Devices already on fixed builds, and devices where SSL VPN is fully disabled (Fortinet's stated workaround); disabling only web mode does not count.

  1. Check the firmware version (`get system status` in the CLI or the dashboard) and upgrade to a fixed build using Fortinet's upgrade path tool.
  2. If you cannot upgrade immediately, disable SSL VPN entirely; disabling web mode alone is not a valid workaround.
  3. Apply the IPS signature HTTP.Chunk.Length.Invalid where FortiGuard virtual patching is available.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 1

GitHub-reviewed advisories rated critical, published this day (Pacific time).

PyPI 1

Check: pip-audit (or: pip show <package>)