Digest · Wednesday
Security digest: April 24, 2024
3 known exploited (cisa kev) additions and 3 critical advisories.
All digests · RSS · Markdown
Take stock
- Do you run any of these? CrushFTP CrushFTP, Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD). They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2024-05-01.
- Go: 2 critical advisories (
github.com/go-gitea/gitea,kubevirt.io/kubevirt). Check withgovulncheck ./.... - PyPI: 1 critical advisory (
pyload-ng). Check withpip-audit (or: pip show <package>). - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 3
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
| CVE | Product and flaw | CISA due |
|---|---|---|
| CVE-2024-4040 | CrushFTP CrushFTP CrushFTP VFS Sandbox Escape Vulnerability | 2024-05-01 |
| CVE-2024-20359 | Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Cisco ASA and FTD Privilege Escalation Vulnerability | 2024-05-01 |
| CVE-2024-20353 | Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Cisco ASA and FTD Denial of Service Vulnerability | 2024-05-01 |
Critical advisories by ecosystem 3
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Go 2
Check: govulncheck ./...
- Improper Access Control in Gitea CVE-2020-28991 CVSS 9.8 Critical
github.com/go-gitea/gitea>= 0.9.99, < 1.12.6 → fixed in 1.12.6 - Privilege Escalation in kubevirt CVE-2020-14316 CVSS 9.9 Critical
kubevirt.io/kubevirt< 0.30.0 → fixed in 0.30.0
PyPI 1
Check: pip-audit (or: pip show <package>)
- pyLoad allows upload to arbitrary folder lead to RCE CVE-2024-32880 CVSS 9.1 Critical
pyload-ng<= 0.5.0 → no fix listed