--- title: "Security digest: May 15, 2024" url: https://erroneo.us/security/2024-05-15/ description: "May 15, 2024 vulnerability digest: 20 critical advisories (Maven, Composer (PHP)). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2024-05-15 date_modified: 2024-05-15 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: May 15, 2024 20 critical advisories. ## Take stock - Composer (PHP): 19 critical advisories ( contao/core , laravel/framework , magento/community-edition , drupal/drupal , adodb/adodb-php , firebase/php-jwt , gree/jose , drupal/core …). Check with composer audit . - Maven: 1 critical advisory ( com.amazon.redshift:redshift-jdbc42 ). Check with mvn dependency:tree -Dincludes=: . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) None. ## Critical advisories - [CVE-2024-32888](https://erroneo.us/security/cve/CVE-2024-32888/index.md) Amazon JDBC Driver for Redshift SQL Injection via line comment generation — Maven com.amazon.redshift:redshift-jdbc42 < 2.1.0.28 → 2.1.0.28 - [GHSA-wxxw-5gq6-j2g5](https://erroneo.us/security/ghsa/GHSA-wxxw-5gq6-j2g5/index.md) contao/core Insufficient input validation allows for code injection and remote execution — Composer (PHP) contao/core >= 2.0.0, < 2.11.17 → 2.11.17; Composer (PHP) contao/core >= 3.0.0, < 3.2.9 → 3.2.9 - [GHSA-qm5c-m76r-2hfr](https://erroneo.us/security/ghsa/GHSA-qm5c-m76r-2hfr/index.md) Laravel RCE vulnerability in "cookie" session driver — Composer (PHP) laravel/framework >= 4.1.0, < 6.18.31 → 6.18.31; Composer (PHP) laravel/framework >= 7.0.0, < 7.22.4 → 7.22.4 - [GHSA-prpf-cj87-hwvr](https://erroneo.us/security/ghsa/GHSA-prpf-cj87-hwvr/index.md) Magento Patch SUPEE-10752 - Multiple security enhancements vulnerabilities — Composer (PHP) magento/community-edition < 1.9.3.9 → 1.9.3.9 - [GHSA-jjx7-8462-w4m4](https://erroneo.us/security/ghsa/GHSA-jjx7-8462-w4m4/index.md) Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution — Composer (PHP) drupal/drupal >= 8.0.0, < 8.5.8 → 8.5.8; Composer (PHP) drupal/drupal >= 8.6.0, < 8.6.2 → 8.6.2 - [GHSA-jf8c-36vw-98x4](https://erroneo.us/security/ghsa/GHSA-jf8c-36vw-98x4/index.md) Drupal core Remote Code Execution — Composer (PHP) drupal/drupal >= 7.0, < 7.60 → 7.60; Composer (PHP) drupal/drupal >= 8.0.0, < 8.5.8 → 8.5.8; Composer (PHP) drupal/drupal >= 8.6.0, < 8.6.2 → 8.6.2 - [GHSA-h63c-xvpf-264j](https://erroneo.us/security/ghsa/GHSA-h63c-xvpf-264j/index.md) ADOdb SQL injection vulnerability — Composer (PHP) adodb/adodb-php < 5.20.11 → 5.20.11 - [GHSA-h533-5v22-8vcp](https://erroneo.us/security/ghsa/GHSA-h533-5v22-8vcp/index.md) firebase/php-jwt: "None" Algorithm treated as valid on tokens — Composer (PHP) firebase/php-jwt < 2.0.0 → 2.0.0 - [GHSA-cv25-3pxr-4q7x](https://erroneo.us/security/ghsa/GHSA-cv25-3pxr-4q7x/index.md) Magento Open Source Security Advisory: Patch SUPEE-10975 — Composer (PHP) magento/community-edition >= 1.9.0.0, < 1.14.4.0 → 1.14.4.0 - [GHSA-9gxv-x7rp-r2hc](https://erroneo.us/security/ghsa/GHSA-9gxv-x7rp-r2hc/index.md) gree/jose - "None" Algorithm treated as valid in tokens — Composer (PHP) gree/jose < 2.2.1 → 2.2.1 - [GHSA-8j7c-682x-r9f2](https://erroneo.us/security/ghsa/GHSA-8j7c-682x-r9f2/index.md) Magento RCE,XSS and other vulnerabilities — Composer (PHP) magento/community-edition >= 2.1, < 2.1.16 → 2.1.16; Composer (PHP) magento/community-edition >= 2.2, < 2.2.7 → 2.2.7 - [GHSA-7v68-3pr5-h3cr](https://erroneo.us/security/ghsa/GHSA-7v68-3pr5-h3cr/index.md) Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution — Composer (PHP) drupal/core >= 8.0.0, < 8.5.8 → 8.5.8; Composer (PHP) drupal/core >= 8.6.0, < 8.6.2 → 8.6.2 - [GHSA-6wm4-3rjj-c8xx](https://erroneo.us/security/ghsa/GHSA-6wm4-3rjj-c8xx/index.md) Magento Security enhancements that help close RCE,XSS,CSRF and other vulnerabilities — Composer (PHP) magento/community-edition >= 1.5.0.0, < 1.9.4.0 → 1.9.4.0 - [GHSA-6q9v-4hq6-5m67](https://erroneo.us/security/ghsa/GHSA-6q9v-4hq6-5m67/index.md) Doctrine SQL injection vulnerability — Composer (PHP) doctrine/orm >= 2.0.0, < 2.0.3 → 2.0.3; Composer (PHP) doctrine/orm >= 1.0.0, < 1.2.4 → 1.2.4 - [GHSA-6mgp-v5cm-ghg5](https://erroneo.us/security/ghsa/GHSA-6mgp-v5cm-ghg5/index.md) Drupal core Remote Code Execution — Composer (PHP) drupal/core >= 7.0, < 7.60 → 7.60; Composer (PHP) drupal/core >= 8.0.0, < 8.5.8 → 8.5.8; Composer (PHP) drupal/core >= 8.6.0, < 8.6.2 → 8.6.2 - [GHSA-5gmh-85x8-5cx7](https://erroneo.us/security/ghsa/GHSA-5gmh-85x8-5cx7/index.md) Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities — Composer (PHP) magento/community-edition >= 2.1, < 2.1.14 → 2.1.14; Composer (PHP) magento/community-edition >= 2.2, < 2.2.5 → 2.2.5 - [CVE-2020-35125](https://erroneo.us/security/cve/CVE-2020-35125/index.md) Mautic is vulnerable to XSS vulnerability — Composer (PHP) mautic/core < 2.16.5 → 2.16.5; Composer (PHP) mautic/core >= 3.0.0, < 3.2.4 → 3.2.4 - [GHSA-2ffv-r4r9-r8xr](https://erroneo.us/security/ghsa/GHSA-2ffv-r4r9-r8xr/index.md) Laravel RCE vulnerability in "cookie" session driver — Composer (PHP) illuminate/cookie >= 4.1.0, < 6.18.31 → 6.18.31; Composer (PHP) illuminate/cookie >= 7.0.0, < 7.22.4 → 7.22.4 - [GHSA-27qr-636m-wxg2](https://erroneo.us/security/ghsa/GHSA-27qr-636m-wxg2/index.md) codeigniter/framework SQL injection in ODBC database driver — Composer (PHP) codeigniter/framework < 3.1.0 → 3.1.0 - [GHSA-26hq-7286-mg8f](https://erroneo.us/security/ghsa/GHSA-26hq-7286-mg8f/index.md) Magento Patch SUPEE-9652 - Remote Code Execution using mail vulnerability — Composer (PHP) magento/community-edition >= 1.9.0.0, < 1.14.3.2 → 1.14.3.2 --- Source page: https://erroneo.us/security/2024-05-15/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt