Digest · Thursday
Security digest: May 2, 2024
6 critical advisories.
All digests · RSS · Markdown
Take stock
- npm: 4 critical advisories (
libxmljs2,libxmljs). Check withnpm audit (or: npm ls <package>). - crates.io (Rust): 1 critical advisory (
apollo-router). Check withcargo audit. - PyPI: 1 critical advisory (
cbpi4). Check withpip-audit (or: pip show <package>). - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 0
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
None.
Critical advisories by ecosystem 6
GitHub-reviewed advisories rated critical, published this day (Pacific time).
npm 4
Check: npm audit (or: npm ls <package>)
- libxmljs2 type confusion vulnerability when parsing specially crafted XML CVE-2024-34393 CVSS 9.2 Critical
libxmljs2<= 0.33.0 → no fix listed - libxmljs vulnerable to type confusion when parsing specially crafted XML CVE-2024-34392 CVSS 9.3 Critical
libxmljs<= 1.0.11 → no fix listed - libxmljs2 vulnerable to type confusion when parsing specially crafted XML CVE-2024-34394 CVSS 9.2 Critical
libxmljs2<= 0.35.0 → no fix listed - libxmljs vulnerable to type confusion when parsing specially crafted XML CVE-2024-34391 CVSS 9.2 Critical
libxmljs<= 1.0.11 → no fix listed
PyPI 1
Check: pip-audit (or: pip show <package>)
- CraftBeerPi 4 allows arbitrary code execution CVE-2024-3955 CVSS 9.8 Critical
cbpi4>= 4.0.0.58, < 4.4.1.a1 → fixed in 4.4.1.a1
crates.io (Rust) 1
Check: cargo audit
- Apollo Router vulnerable to Critical Regression In Query Plan Cache CVE-2024-32971 CVSS 9.0 Critical
apollo-router>= 1.44.0, < 1.45.1 → fixed in 1.45.1