Digest · Wednesday

Security digest: April 10, 2024

17 critical advisories.

Take stock

Maven: 10 critical advisories (org.xwiki.platform:xwiki-platform-localization-source-wiki, org.xwiki.platform:xwiki-platform-search-solr-ui, org.xwiki.platform:xwiki-platform-oldcore, org.xwiki.platform:xwiki-platform-realtime-ui, org.xwiki.commons:xwiki-commons-velocity, org.xwiki.platform:xwiki-platform-uiextension-api, org.xwiki.platform:xwiki-platform-scheduler-ui, org.xwiki.platform:xwiki-platform-search-ui). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
PyPI: 3 critical advisories (llama-index-core, aim, litellm). Check with pip-audit (or: pip show <package>).
Go: 2 critical advisories (github.com/go-skynet/LocalAI, github.com/evmos/evmos/v16, github.com/evmos/evmos/v7, github.com/evmos/evmos/v6, github.com/evmos/evmos/v5, github.com/tharsis/evmos, github.com/tharsis/evmos/v2, github.com/tharsis/evmos/v3 …). Check with govulncheck ./....
Composer (PHP): 1 critical advisory (wwbn/avideo). Check with composer audit.
npm: 1 critical advisory (mysql2). Check with npm audit (or: npm ls <package>).
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 17

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Maven 10

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

XWiki Platform: Remote code execution from edit in multilingual wikis via translations CVE-2024-31983 CVSS 9.9 Critical
org.xwiki.platform:xwiki-platform-localization-source-wiki >= 4.3-milestone-2, < 14.10.20 → fixed in 14.10.20; org.xwiki.platform:xwiki-platform-localization-source-wiki >= 15.0-rc-1, < 15.5.4 → fixed in 15.5.4; org.xwiki.platform:xwiki-platform-localization-source-wiki >= 15.6-rc-1, < 15.10-rc-1 → fixed in 15.10-rc-1
XWiki Platform: Remote code execution through space title and Solr space facet CVE-2024-31984 CVSS 9.9 Critical
org.xwiki.platform:xwiki-platform-search-solr-ui >= 7.2-rc-1, < 14.10.20 → fixed in 14.10.20; org.xwiki.platform:xwiki-platform-search-solr-ui >= 15.0-rc-1, < 15.5.4 → fixed in 15.5.4; org.xwiki.platform:xwiki-platform-search-solr-ui >= 15.6-rc-1, < 15.10-rc-1 → fixed in 15.10-rc-1
XWiki Platform: Privilege escalation (PR) from user registration through PDFClass CVE-2024-31981 CVSS 9.9 Critical
org.xwiki.platform:xwiki-platform-oldcore >= 3.0.1, < 14.10.20 → fixed in 14.10.20; org.xwiki.platform:xwiki-platform-oldcore >= 15.0-rc-1, < 15.5.4 → fixed in 15.5.4; org.xwiki.platform:xwiki-platform-oldcore >= 15.6-rc-1, < 15.10-rc-1 → fixed in 15.10-rc-1
XWiki Platform CSRF remote code execution through the realtime HTML Converter API CVE-2024-31988 CVSS 9.6 Critical
org.xwiki.platform:xwiki-platform-realtime-ui >= 13.9-rc-1, < 14.10.19 → fixed in 14.10.19; org.xwiki.platform:xwiki-platform-realtime-ui >= 15.0-rc-1, < 15.5.4 → fixed in 15.5.4; org.xwiki.platform:xwiki-platform-realtime-ui >= 15.6-rc-1, < 15.9 → fixed in 15.9
XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution CVE-2024-31996 CVSS 10.0 Critical
org.xwiki.commons:xwiki-commons-velocity >= 3.0.1, < 14.10.19 → fixed in 14.10.19; org.xwiki.commons:xwiki-commons-velocity >= 15.0-rc-1, < 15.5.4 → fixed in 15.5.4; org.xwiki.commons:xwiki-commons-velocity >= 15.6-rc-1, < 15.9-rc-1 → fixed in 15.9-rc-1
XWiki Platform remote code execution from account via custom skins support CVE-2024-31987 CVSS 9.9 Critical
org.xwiki.platform:xwiki-platform-oldcore >= 6.4-milestone-1, < 14.10.19 → fixed in 14.10.19; org.xwiki.platform:xwiki-platform-oldcore >= 15.0-rc-1, < 15.5.4 → fixed in 15.5.4; org.xwiki.platform:xwiki-platform-oldcore >= 15.6-rc-1, < 15.10-rc-1 → fixed in 15.10-rc-1
XWiki Platform remote code execution from account through UIExtension parameters CVE-2024-31997 CVSS 9.9 Critical
org.xwiki.platform:xwiki-platform-uiextension-api < 14.10.19 → fixed in 14.10.19; org.xwiki.platform:xwiki-platform-uiextension-api >= 15.0-rc-1, < 15.5.4 → fixed in 15.5.4; org.xwiki.platform:xwiki-platform-uiextension-api >= 15.6-rc-1, < 15.9-rc-1 → fixed in 15.9-rc-1
XWiki Platform CSRF remote code execution through scheduler job's document reference CVE-2024-31986 CVSS 9.0 Critical
org.xwiki.platform:xwiki-platform-scheduler-ui >= 3.1, < 14.10.19 → fixed in 14.10.19; org.xwiki.platform:xwiki-platform-scheduler-ui >= 15.0-rc-1, < 15.5.4 → fixed in 15.5.4; org.xwiki.platform:xwiki-platform-scheduler-ui >= 15.6-rc-1, < 15.9 → fixed in 15.9
XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet CVE-2024-31465 CVSS 9.9 Critical
org.xwiki.platform:xwiki-platform-search-ui >= 5.2-milestone-2, < 14.10.20 → fixed in 14.10.20; org.xwiki.platform:xwiki-platform-search-ui >= 15.0-rc-1, < 15.5.4 → fixed in 15.5.4; org.xwiki.platform:xwiki-platform-search-ui >= 15.6-rc-1, < 15.10-rc-1 → fixed in 15.10-rc-1
XWiki Platform: Remote code execution as guest via DatabaseSearch CVE-2024-31982 CVSS 10.0 Critical
org.xwiki.platform:xwiki-platform-search-ui >= 2.4-milestone-1, < 14.10.20 → fixed in 14.10.20; org.xwiki.platform:xwiki-platform-search-ui >= 15.0-rc-1, < 15.5.4 → fixed in 15.5.4; org.xwiki.platform:xwiki-platform-search-ui >= 15.6-rc-1, < 15.10-rc-1 → fixed in 15.10-rc-1

PyPI 3

Check: pip-audit (or: pip show <package>)

llama-index-core Prompt Injection vulnerability leading to Arbitrary Code Execution CVE-2024-3098 CVSS 9.8 Critical
llama-index-core < 0.10.24 → fixed in 0.10.24
Aim Web API vulnerable to Remote Code Execution CVE-2024-2195 CVSS 9.8 Critical
aim >= 3.0.0, <= 3.25.0 → no fix listed
LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint CVE-2024-2952 CVSS 9.8 Critical
litellm < 1.34.42 → fixed in 1.34.42

Go 2

Check: govulncheck ./...

LocalAI Command Injection in audioToWav CVE-2024-2029 CVSS 9.3 Critical
github.com/go-skynet/LocalAI < 2.10.0 → fixed in 2.10.0
Evmos transaction execution not accounting for all state transition after interaction with precompiles CVE-2024-32644 CVSS 9.1 Critical
github.com/evmos/evmos/v16 <= 16.0.4 → fixed in 17.0.0; github.com/evmos/evmos/v7 <= 7.0.0 → no fix listed; github.com/evmos/evmos/v6 <= 6.0.4 → no fix listed; +6 more packages

Composer (PHP) 1

Check: composer audit

WWBN AVideo Remote Code Execution CVE-2024-31819 CVSS 9.3 Critical
wwbn/avideo >= 12.4, <= 14.2 → fixed in 14.3

npm 1

Check: npm audit (or: npm ls <package>)

mysql2 Remote Code Execution (RCE) via the readCodeFor function CVE-2024-21508 CVSS 9.8 Critical
mysql2 < 3.9.4 → fixed in 3.9.4