Digest · Wednesday

Security digest: February 21, 2024

3 critical advisories.

Take stock

Maven: 2 critical advisories (com.liferay.portal:release.portal.bom, com.liferay.portal:release.dxp.bom, org.postgresql:postgresql). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
PyPI: 1 critical advisory (pymatgen). Check with pip-audit (or: pip show <package>).
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

Liferay Portal Document and Media widget and Liferay DXP vulnerable to stored Cross-site Scripting CVE-2023-47795 CVSS 9.0 Critical
com.liferay.portal:release.portal.bom >= 7.4.3.18, <= 7.4.3.101 → fixed in 7.4.3.102; com.liferay.portal:release.dxp.bom >= 2023.Q3, < 2023.Q3.6 → fixed in 2023.Q3.6; com.liferay.portal:release.dxp.bom >= 7.4.13.u18, <= 7.4.13.u92 → no fix listed
org.postgresql:postgresql vulnerable to SQL Injection via line comment generation CVE-2024-1597 CVSS 10.0 Critical
org.postgresql:postgresql < 42.2.28 → fixed in 42.2.28; org.postgresql:postgresql >= 42.3.0, < 42.3.9 → fixed in 42.3.9; org.postgresql:postgresql >= 42.4.0, < 42.4.4 → fixed in 42.4.4; +3 more packages

Check: pip-audit (or: pip show <package>)

pymatgen vulnerable to arbitrary code execution when parsing a maliciously crafted JonesFaithfulTransformation transformation_string CVE-2024-23346 CVSS 9.3 Critical
pymatgen < 2024.2.20 → fixed in 2024.2.20