--- title: "Security digest: February 20, 2024" url: https://erroneo.us/security/2024-02-20/ description: "February 20, 2024 vulnerability digest: 14 critical advisories (Maven, PyPI, npm). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2024-02-20 date_modified: 2024-02-20 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: February 20, 2024 14 critical advisories. ## Take stock - Maven: 12 critical advisories ( com.liferay.portal:release.portal.bom , com.liferay.portal:release.dxp.bom , com.liferay.portal:com.liferay.portal.web , org.apache.dolphinscheduler:dolphinscheduler ). Check with mvn dependency:tree -Dincludes=: . - PyPI: 1 critical advisory ( apache-airflow-providers-mongo ). Check with pip-audit (or: pip show ) . - npm: 1 critical advisory ( @dfinity/identity , @dfinity/auth-client ). Check with npm audit (or: npm ls ) . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) None. ## Critical advisories - [CVE-2024-25147](https://erroneo.us/security/cve/CVE-2024-25147/index.md) Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting — Maven com.liferay.portal:release.portal.bom <= 7.4.1 → no fix; Maven com.liferay.portal:release.dxp.bom >= 7.3.0, < 7.3.10.u4 → 7.3.10.u4; Maven com.liferay.portal:release.dxp.bom >= 7.2.0, < 7.2.10.fp15 → 7.2.10.fp15 - [CVE-2024-25141](https://erroneo.us/security/cve/CVE-2024-25141/index.md) Improper Certificate Validation in apache airflow mongo hook — PyPI apache-airflow-providers-mongo < 4.0.0 → 4.0.0 - [CVE-2024-25610](https://erroneo.us/security/cve/CVE-2024-25610/index.md) Liferay Portal has a Stored XSS with Blog entries (Insecure defaults) — Maven com.liferay.portal:release.portal.bom < 7.4.3.13 → 7.4.3.13; Maven com.liferay.portal:release.dxp.bom >= 7.4.0, < 7.4.13.u9 → 7.4.13.u9; Maven com.liferay.portal:release.dxp.bom >= 7.3.0, < 7.3.10.u4 → 7.3.10.u4 - [CVE-2024-25602](https://erroneo.us/security/cve/CVE-2024-25602/index.md) Liferay Portal and Liferay DXP's Users Admin module vulnerable to stored Cross-site Scripting — Maven com.liferay.portal:release.portal.bom <= 7.4.2 → no fix; Maven com.liferay.portal:release.dxp.bom >= 7.3.0, < 7.3.10.u4 → 7.3.10.u4; Maven com.liferay.portal:release.dxp.bom >= 7.2.0, < 7.2.10.fp17 → 7.2.10.fp17 - [CVE-2024-26266](https://erroneo.us/security/cve/CVE-2024-26266/index.md) Liferay Portal and Liferay DXP vulnerable to stored Cross-site Scripting — Maven com.liferay.portal:release.portal.bom <= 7.4.3.13 → 7.4.3.14; Maven com.liferay.portal:release.dxp.bom >= 7.4.13.u1, < 7.4.13.u10 → 7.4.13.u10; Maven com.liferay.portal:release.dxp.bom >= 7.3.10.ep3, < 7.3.10.u4 → 7.3.10.u4 - [CVE-2024-26269](https://erroneo.us/security/cve/CVE-2024-26269/index.md) Liferay Portal Frontend JS module's portlet.js and Liferay DXP vulnerable to Cross-site Scripting — Maven com.liferay.portal:release.portal.bom >= 7.2.0, <= 7.4.3.37 → 7.4.3.38; Maven com.liferay.portal:release.dxp.bom >= 7.4.13.u1, < 7.4.13.u38 → 7.4.13.u38; Maven com.liferay.portal:release.dxp.bom >= 7.3.10.ep3, < 7.3.10.u11 → 7.3.10.u11 - [CVE-2023-49109](https://erroneo.us/security/cve/CVE-2023-49109/index.md) Remote Code Execution in Apache Dolphinscheduler — Maven org.apache.dolphinscheduler:dolphinscheduler >= 3.0.0, < 3.2.1 → 3.2.1 - [CVE-2024-25152](https://erroneo.us/security/cve/CVE-2024-25152/index.md) Liferay Portal Message Board widget and Liferay DXP vulnerable to stored Cross-site Scripting — Maven com.liferay.portal:release.portal.bom <= 7.4.2 → no fix; Maven com.liferay.portal:release.dxp.bom >= 7.3.0, < 7.3.10.u4 → 7.3.10.u4; Maven com.liferay.portal:release.dxp.bom >= 7.2.0, < 7.2.10.fp17 → 7.2.10.fp17 - [CVE-2024-25601](https://erroneo.us/security/cve/CVE-2024-25601/index.md) Liferay Portal Expando module and Liferay DXP vulnerable to stored Cross-site Scripting — Maven com.liferay.portal:release.portal.bom <= 7.4.2 → no fix; Maven com.liferay.portal:release.dxp.bom >= 7.3.0, < 7.3.10.u4 → 7.3.10.u4; Maven com.liferay.portal:release.dxp.bom >= 7.2.0, < 7.2.10.fp17 → 7.2.10.fp17 - [CVE-2024-1631](https://erroneo.us/security/cve/CVE-2024-1631/index.md) agent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate` — npm @dfinity/identity >= 0.20.0-beta.0, < 1.0.1 → 1.0.1; npm @dfinity/auth-client >= 0.20.0-beta.0, < 1.0.1 → 1.0.1 - [CVE-2023-42498](https://erroneo.us/security/cve/CVE-2023-42498/index.md) Liferay Portal Language Override edit screen and Liferay DXP vulnerable to reflected Cross-site Scripting — Maven com.liferay.portal:release.portal.bom >= 7.4.3.8, <= 7.4.3.97 → 7.4.3.98; Maven com.liferay.portal:release.dxp.bom >= 2023.Q3, < 2023.Q3.5 → 2023.Q3.5; Maven com.liferay.portal:release.dxp.bom >= 7.4.13.u4, <= 7.4.13.u92 → no fix - [CVE-2023-42496](https://erroneo.us/security/cve/CVE-2023-42496/index.md) Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting — Maven com.liferay.portal:release.portal.bom >= 7.3.3, <= 7.4.3.97 → 7.4.3.98; Maven com.liferay.portal:release.dxp.bom >= 7.4.10.ep1, <= 7.4.13.u92 → no fix; Maven com.liferay.portal:release.dxp.bom >= 7.3.10.ep3, < 7.3.10.u34 → 7.3.10.u34 - [CVE-2023-40191](https://erroneo.us/security/cve/CVE-2023-40191/index.md) Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting — Maven com.liferay.portal:release.portal.bom >= 7.4.3.44, <= 7.4.3.97 → 7.4.3.98; Maven com.liferay.portal:release.dxp.bom >= 2023.Q3, < 2023.Q3.6 → 2023.Q3.6; Maven com.liferay.portal:release.dxp.bom >= 7.4.13.u44, <= 7.4.13.u92 → no fix - [CVE-2024-25603](https://erroneo.us/security/cve/CVE-2024-25603/index.md) Liferay Portal's Dynamic Data Mapping module's DDMForm and Liferay DXP vulnerable to stored Cross-site Scripting — Maven com.liferay.portal:release.portal.bom <= 7.4.3.4 → 7.4.3.5; Maven com.liferay.portal:release.dxp.bom >= 7.4.13.u1, <= 7.4.13.u102 → no fix; Maven com.liferay.portal:release.dxp.bom >= 7.3.10.ep3, < 7.3.10.u4 → 7.3.10.u4 --- Source page: https://erroneo.us/security/2024-02-20/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt