Digest · Monday
Security digest: February 26, 2024
4 critical advisories.
All digests · RSS · Markdown
Take stock
- Maven: 2 critical advisories (
com.linecorp.centraldogma:centraldogma-server-auth-saml,com.linecorp.armeria:armeria-saml). Check withmvn dependency:tree -Dincludes=<groupId>:<artifactId>. - PyPI: 1 critical advisory (
langchain-experimental). Check withpip-audit (or: pip show <package>). - npm: 1 critical advisory (
@nfid/embed). Check withnpm audit (or: npm ls <package>). - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 0
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
None.
Critical advisories by ecosystem 4
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Maven 2
Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>
- SAML authentication bypass due to missing validation on unsigned SAML messages GHSA-hx5q-v6pj-533r CVSS 9.1 Critical
com.linecorp.centraldogma:centraldogma-server-auth-saml<= 0.64.2 → fixed in 0.64.3 - Armeria SAML authentication bypass due to missing validation on unsigned SAML messages CVE-2024-1735 CVSS 9.1 Critical
com.linecorp.armeria:armeria-saml<= 1.27.1 → fixed in 1.27.2
npm 1
Check: npm audit (or: npm ls <package>)
- @nfid/embed has compromised private key due to @dfinity/auth-client producing insecure session keys GHSA-84c3-j8r2-mcm8 CVSS 9.1 Critical
@nfid/embed>= 0.10.0, < 0.10.1-alpha.6 → fixed in 0.10.1-alpha.6
PyPI 1
Check: pip-audit (or: pip show <package>)
- LangChain Experimental vulnerable to arbitrary code execution CVE-2024-27444 CVSS 9.3 Critical
langchain-experimental< 0.0.52 → fixed in 0.0.52