--- title: "Security digest: February 21, 2024" url: https://erroneo.us/security/2024-02-21/ description: "February 21, 2024 vulnerability digest: 3 critical advisories (PyPI, Maven). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2024-02-21 date_modified: 2024-02-21 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: February 21, 2024 3 critical advisories. ## Take stock - Maven: 2 critical advisories ( com.liferay.portal:release.portal.bom , com.liferay.portal:release.dxp.bom , org.postgresql:postgresql ). Check with mvn dependency:tree -Dincludes=: . - PyPI: 1 critical advisory ( pymatgen ). Check with pip-audit (or: pip show ) . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) None. ## Critical advisories - [CVE-2024-23346](https://erroneo.us/security/cve/CVE-2024-23346/index.md) pymatgen vulnerable to arbitrary code execution when parsing a maliciously crafted JonesFaithfulTransformation transformation_string — PyPI pymatgen < 2024.2.20 → 2024.2.20 - [CVE-2023-47795](https://erroneo.us/security/cve/CVE-2023-47795/index.md) Liferay Portal Document and Media widget and Liferay DXP vulnerable to stored Cross-site Scripting — Maven com.liferay.portal:release.portal.bom >= 7.4.3.18, <= 7.4.3.101 → 7.4.3.102; Maven com.liferay.portal:release.dxp.bom >= 2023.Q3, < 2023.Q3.6 → 2023.Q3.6; Maven com.liferay.portal:release.dxp.bom >= 7.4.13.u18, <= 7.4.13.u92 → no fix - [CVE-2024-1597](https://erroneo.us/security/cve/CVE-2024-1597/index.md) org.postgresql:postgresql vulnerable to SQL Injection via line comment generation — Maven org.postgresql:postgresql < 42.2.28 → 42.2.28; Maven org.postgresql:postgresql >= 42.3.0, < 42.3.9 → 42.3.9; Maven org.postgresql:postgresql >= 42.4.0, < 42.4.4 → 42.4.4 --- Source page: https://erroneo.us/security/2024-02-21/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt