Digest · Tuesday

Security digest: February 20, 2024

14 critical advisories.

Take stock

Maven: 12 critical advisories (com.liferay.portal:release.portal.bom, com.liferay.portal:release.dxp.bom, com.liferay.portal:com.liferay.portal.web, org.apache.dolphinscheduler:dolphinscheduler). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
PyPI: 1 critical advisory (apache-airflow-providers-mongo). Check with pip-audit (or: pip show <package>).
npm: 1 critical advisory (@dfinity/identity, @dfinity/auth-client). Check with npm audit (or: npm ls <package>).
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 14

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Maven 12

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting CVE-2024-25147 CVSS 9.6 Critical
com.liferay.portal:release.portal.bom <= 7.4.1 → no fix listed; com.liferay.portal:release.dxp.bom >= 7.3.0, < 7.3.10.u4 → fixed in 7.3.10.u4; com.liferay.portal:release.dxp.bom >= 7.2.0, < 7.2.10.fp15 → fixed in 7.2.10.fp15
Liferay Portal has a Stored XSS with Blog entries (Insecure defaults) CVE-2024-25610 CVSS 9.0 Critical
com.liferay.portal:release.portal.bom < 7.4.3.13 → fixed in 7.4.3.13; com.liferay.portal:release.dxp.bom >= 7.4.0, < 7.4.13.u9 → fixed in 7.4.13.u9; com.liferay.portal:release.dxp.bom >= 7.3.0, < 7.3.10.u4 → fixed in 7.3.10.u4; +2 more packages
Liferay Portal and Liferay DXP's Users Admin module vulnerable to stored Cross-site Scripting CVE-2024-25602 CVSS 9.0 Critical
com.liferay.portal:release.portal.bom <= 7.4.2 → no fix listed; com.liferay.portal:release.dxp.bom >= 7.3.0, < 7.3.10.u4 → fixed in 7.3.10.u4; com.liferay.portal:release.dxp.bom >= 7.2.0, < 7.2.10.fp17 → fixed in 7.2.10.fp17
Liferay Portal and Liferay DXP vulnerable to stored Cross-site Scripting CVE-2024-26266 CVSS 9.0 Critical
com.liferay.portal:release.portal.bom <= 7.4.3.13 → fixed in 7.4.3.14; com.liferay.portal:release.dxp.bom >= 7.4.13.u1, < 7.4.13.u10 → fixed in 7.4.13.u10; com.liferay.portal:release.dxp.bom >= 7.3.10.ep3, < 7.3.10.u4 → fixed in 7.3.10.u4; +1 more packages
Liferay Portal Frontend JS module's portlet.js and Liferay DXP vulnerable to Cross-site Scripting CVE-2024-26269 CVSS 9.6 Critical
com.liferay.portal:release.portal.bom >= 7.2.0, <= 7.4.3.37 → fixed in 7.4.3.38; com.liferay.portal:release.dxp.bom >= 7.4.13.u1, < 7.4.13.u38 → fixed in 7.4.13.u38; com.liferay.portal:release.dxp.bom >= 7.3.10.ep3, < 7.3.10.u11 → fixed in 7.3.10.u11; +1 more packages
Remote Code Execution in Apache Dolphinscheduler CVE-2023-49109 CVSS 9.8 Critical
org.apache.dolphinscheduler:dolphinscheduler >= 3.0.0, < 3.2.1 → fixed in 3.2.1
Liferay Portal Message Board widget and Liferay DXP vulnerable to stored Cross-site Scripting CVE-2024-25152 CVSS 9.0 Critical
com.liferay.portal:release.portal.bom <= 7.4.2 → no fix listed; com.liferay.portal:release.dxp.bom >= 7.3.0, < 7.3.10.u4 → fixed in 7.3.10.u4; com.liferay.portal:release.dxp.bom >= 7.2.0, < 7.2.10.fp17 → fixed in 7.2.10.fp17
Liferay Portal Expando module and Liferay DXP vulnerable to stored Cross-site Scripting CVE-2024-25601 CVSS 9.0 Critical
com.liferay.portal:release.portal.bom <= 7.4.2 → no fix listed; com.liferay.portal:release.dxp.bom >= 7.3.0, < 7.3.10.u4 → fixed in 7.3.10.u4; com.liferay.portal:release.dxp.bom >= 7.2.0, < 7.2.10.fp17 → fixed in 7.2.10.fp17
Liferay Portal Language Override edit screen and Liferay DXP vulnerable to reflected Cross-site Scripting CVE-2023-42498 CVSS 9.6 Critical
com.liferay.portal:release.portal.bom >= 7.4.3.8, <= 7.4.3.97 → fixed in 7.4.3.98; com.liferay.portal:release.dxp.bom >= 2023.Q3, < 2023.Q3.5 → fixed in 2023.Q3.5; com.liferay.portal:release.dxp.bom >= 7.4.13.u4, <= 7.4.13.u92 → no fix listed
Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting CVE-2023-42496 CVSS 9.6 Critical
com.liferay.portal:release.portal.bom >= 7.3.3, <= 7.4.3.97 → fixed in 7.4.3.98; com.liferay.portal:release.dxp.bom >= 7.4.10.ep1, <= 7.4.13.u92 → no fix listed; com.liferay.portal:release.dxp.bom >= 7.3.10.ep3, < 7.3.10.u34 → fixed in 7.3.10.u34; +1 more packages
Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting CVE-2023-40191 CVSS 9.0 Critical
com.liferay.portal:release.portal.bom >= 7.4.3.44, <= 7.4.3.97 → fixed in 7.4.3.98; com.liferay.portal:release.dxp.bom >= 2023.Q3, < 2023.Q3.6 → fixed in 2023.Q3.6; com.liferay.portal:release.dxp.bom >= 7.4.13.u44, <= 7.4.13.u92 → no fix listed
Liferay Portal's Dynamic Data Mapping module's DDMForm and Liferay DXP vulnerable to stored Cross-site Scripting CVE-2024-25603 CVSS 9.0 Critical
com.liferay.portal:release.portal.bom <= 7.4.3.4 → fixed in 7.4.3.5; com.liferay.portal:release.dxp.bom >= 7.4.13.u1, <= 7.4.13.u102 → no fix listed; com.liferay.portal:release.dxp.bom >= 7.3.10.ep3, < 7.3.10.u4 → fixed in 7.3.10.u4; +1 more packages

npm 1

Check: npm audit (or: npm ls <package>)

agent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate` CVE-2024-1631 CVSS 9.1 Critical
@dfinity/identity >= 0.20.0-beta.0, < 1.0.1 → fixed in 1.0.1; @dfinity/auth-client >= 0.20.0-beta.0, < 1.0.1 → fixed in 1.0.1

PyPI 1

Check: pip-audit (or: pip show <package>)

Improper Certificate Validation in apache airflow mongo hook CVE-2024-25141 CVSS 9.1 Critical
apache-airflow-providers-mongo < 4.0.0 → fixed in 4.0.0