---
title: "Security digest: April 24, 2024"
url: https://erroneo.us/security/2024-04-24/
description: "April 24, 2024 vulnerability digest: 3 CISA KEV additions (Cisco, CrushFTP); 3 critical advisories (Go, PyPI). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2024-04-24
date_modified: 2024-04-24
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: April 24, 2024

3 known exploited (cisa kev) additions and 3 critical advisories.

## Take stock

- Do you run any of these? CrushFTP CrushFTP, Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD). They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2024-05-01.
- Go: 2 critical advisories ( github.com/go-gitea/gitea , kubevirt.io/kubevirt ). Check with govulncheck ./... .
- PyPI: 1 critical advisory ( pyload-ng ). Check with pip-audit (or: pip show <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2024-4040](https://erroneo.us/security/cve/CVE-2024-4040/index.md) CrushFTP CrushFTP: CrushFTP VFS Sandbox Escape Vulnerability (CISA due 2024-05-01)
- [CVE-2024-20359](https://erroneo.us/security/cve/CVE-2024-20359/index.md) Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD): Cisco ASA and FTD Privilege Escalation Vulnerability (CISA due 2024-05-01)
- [CVE-2024-20353](https://erroneo.us/security/cve/CVE-2024-20353/index.md) Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD): Cisco ASA and FTD Denial of Service Vulnerability (CISA due 2024-05-01)

## Critical advisories

- [CVE-2020-28991](https://erroneo.us/security/cve/CVE-2020-28991/index.md) Improper Access Control in Gitea — Go github.com/go-gitea/gitea >= 0.9.99, < 1.12.6 → 1.12.6
- [CVE-2020-14316](https://erroneo.us/security/cve/CVE-2020-14316/index.md) Privilege Escalation in kubevirt — Go kubevirt.io/kubevirt < 0.30.0 → 0.30.0
- [CVE-2024-32880](https://erroneo.us/security/cve/CVE-2024-32880/index.md) pyLoad allows upload to arbitrary folder lead to RCE — PyPI pyload-ng <= 0.5.0 → no fix

---
Source page: https://erroneo.us/security/2024-04-24/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt