Digest · Wednesday

Security digest: May 15, 2024

20 critical advisories.

Take stock

Composer (PHP): 19 critical advisories (contao/core, laravel/framework, magento/community-edition, drupal/drupal, adodb/adodb-php, firebase/php-jwt, gree/jose, drupal/core …). Check with composer audit.
Maven: 1 critical advisory (com.amazon.redshift:redshift-jdbc42). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 20

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Composer (PHP) 19

Check: composer audit

contao/core Insufficient input validation allows for code injection and remote execution GHSA-wxxw-5gq6-j2g5 CVSS 9.0 Critical
contao/core >= 2.0.0, < 2.11.17 → fixed in 2.11.17; contao/core >= 3.0.0, < 3.2.9 → fixed in 3.2.9
Laravel RCE vulnerability in "cookie" session driver GHSA-qm5c-m76r-2hfr CVSS 9.9 Critical
laravel/framework >= 4.1.0, < 6.18.31 → fixed in 6.18.31; laravel/framework >= 7.0.0, < 7.22.4 → fixed in 7.22.4
Magento Patch SUPEE-10752 - Multiple security enhancements vulnerabilities GHSA-prpf-cj87-hwvr
magento/community-edition < 1.9.3.9 → fixed in 1.9.3.9
Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution GHSA-jjx7-8462-w4m4
drupal/drupal >= 8.0.0, < 8.5.8 → fixed in 8.5.8; drupal/drupal >= 8.6.0, < 8.6.2 → fixed in 8.6.2
Drupal core Remote Code Execution GHSA-jf8c-36vw-98x4
drupal/drupal >= 7.0, < 7.60 → fixed in 7.60; drupal/drupal >= 8.0.0, < 8.5.8 → fixed in 8.5.8; drupal/drupal >= 8.6.0, < 8.6.2 → fixed in 8.6.2
ADOdb SQL injection vulnerability GHSA-h63c-xvpf-264j
adodb/adodb-php < 5.20.11 → fixed in 5.20.11
firebase/php-jwt: "None" Algorithm treated as valid on tokens GHSA-h533-5v22-8vcp
firebase/php-jwt < 2.0.0 → fixed in 2.0.0
Magento Open Source Security Advisory: Patch SUPEE-10975 GHSA-cv25-3pxr-4q7x
magento/community-edition >= 1.9.0.0, < 1.14.4.0 → fixed in 1.14.4.0
gree/jose - "None" Algorithm treated as valid in tokens GHSA-9gxv-x7rp-r2hc
gree/jose < 2.2.1 → fixed in 2.2.1
Magento RCE,XSS and other vulnerabilities GHSA-8j7c-682x-r9f2
magento/community-edition >= 2.1, < 2.1.16 → fixed in 2.1.16; magento/community-edition >= 2.2, < 2.2.7 → fixed in 2.2.7
Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution GHSA-7v68-3pr5-h3cr
drupal/core >= 8.0.0, < 8.5.8 → fixed in 8.5.8; drupal/core >= 8.6.0, < 8.6.2 → fixed in 8.6.2
Magento Security enhancements that help close RCE,XSS,CSRF and other vulnerabilities GHSA-6wm4-3rjj-c8xx
magento/community-edition >= 1.5.0.0, < 1.9.4.0 → fixed in 1.9.4.0
Doctrine SQL injection vulnerability GHSA-6q9v-4hq6-5m67
doctrine/orm >= 2.0.0, < 2.0.3 → fixed in 2.0.3; doctrine/orm >= 1.0.0, < 1.2.4 → fixed in 1.2.4
Drupal core Remote Code Execution GHSA-6mgp-v5cm-ghg5
drupal/core >= 7.0, < 7.60 → fixed in 7.60; drupal/core >= 8.0.0, < 8.5.8 → fixed in 8.5.8; drupal/core >= 8.6.0, < 8.6.2 → fixed in 8.6.2
Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities GHSA-5gmh-85x8-5cx7
magento/community-edition >= 2.1, < 2.1.14 → fixed in 2.1.14; magento/community-edition >= 2.2, < 2.2.5 → fixed in 2.2.5
Mautic is vulnerable to XSS vulnerability CVE-2020-35125 CVSS 9.6 Critical
mautic/core < 2.16.5 → fixed in 2.16.5; mautic/core >= 3.0.0, < 3.2.4 → fixed in 3.2.4
Laravel RCE vulnerability in "cookie" session driver GHSA-2ffv-r4r9-r8xr
illuminate/cookie >= 4.1.0, < 6.18.31 → fixed in 6.18.31; illuminate/cookie >= 7.0.0, < 7.22.4 → fixed in 7.22.4
codeigniter/framework SQL injection in ODBC database driver GHSA-27qr-636m-wxg2 CVSS 10.0 Critical
codeigniter/framework < 3.1.0 → fixed in 3.1.0
Magento Patch SUPEE-9652 - Remote Code Execution using mail vulnerability GHSA-26hq-7286-mg8f
magento/community-edition >= 1.9.0.0, < 1.14.3.2 → fixed in 1.14.3.2

Maven 1

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

Amazon JDBC Driver for Redshift SQL Injection via line comment generation CVE-2024-32888 CVSS 10.0 Critical
com.amazon.redshift:redshift-jdbc42 < 2.1.0.28 → fixed in 2.1.0.28