---
title: "Security digest: March 4, 2024"
url: https://erroneo.us/security/2024-03-04/
description: "March 4, 2024 vulnerability digest: 1 CISA KEV addition (Microsoft); 2 critical advisories (npm, Go). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2024-03-04
date_modified: 2024-03-04
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: March 4, 2024

1 known exploited (cisa kev) addition and 2 critical advisories.

## Take stock

- Do you run any of these? Microsoft Windows. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2024-03-25.
- npm: 1 critical advisory ( jsonata ). Check with npm audit (or: npm ls <package>) .
- Go: 1 critical advisory ( github.com/zeromicro/go-zero ). Check with govulncheck ./... .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2024-21338](https://erroneo.us/security/cve/CVE-2024-21338/index.md) Microsoft Windows: Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability (CISA due 2024-03-25)

## Critical advisories

- [CVE-2024-27307](https://erroneo.us/security/cve/CVE-2024-27307/index.md) JSONata expression can pollute the "Object" prototype — npm jsonata >= 1.4.0, < 1.8.7 → 1.8.7; npm jsonata >= 2.0.0, < 2.0.4 → 2.0.4
- [CVE-2024-27302](https://erroneo.us/security/cve/CVE-2024-27302/index.md) Authorization Bypass Through User-Controlled Key in go-zero — Go github.com/zeromicro/go-zero < 1.4.4 → 1.4.4

---
Source page: https://erroneo.us/security/2024-03-04/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt