Digest · Wednesday
Security digest: May 29, 2024
1 known exploited (cisa kev) addition and 2 critical advisories.
All digests · RSS · Markdown
Take stock
- Do you run any of these? Justice AV Solutions Viewer. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2024-06-19.
- Composer (PHP): 2 critical advisories (
symfony/serializer,swiftmailer/swiftmailer). Check withcomposer audit. - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 1
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
| CVE | Product and flaw | CISA due |
|---|---|---|
| CVE-2024-4978 | Justice AV Solutions Viewer Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code Vulnerability | 2024-06-19 |
Critical advisories by ecosystem 2
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Composer (PHP) 2
Check: composer audit
- Symfony XML decoding attack vector through external entities GHSA-j68w-pg49-f6vx CVSS 9.8 Critical
symfony/serializer>= 2.0.0, < 2.0.11 → fixed in 2.0.11 - Swiftmailer Sendmail transport arbitrary shell execution GHSA-4qpj-gxxg-jqg4
swiftmailer/swiftmailer>= 4.0.0, < 5.2.1 → fixed in 5.2.1