--- title: "Security digest: June 2, 2024" url: https://erroneo.us/security/2024-06-02/ description: "June 2, 2024 vulnerability digest: 1 brief (Snowflake / UNC5537); 2 critical advisories (crates.io (Rust), Maven). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2024-06-02 date_modified: 2026-10-21 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: June 2, 2024 1 editorial brief and 2 critical advisories. ## Take stock - Check exposure: Snowflake / UNC5537 . Anyone running Snowflake or a similar SaaS data warehouse with human or service users that still sign in with a password and no second factor, key pair or SSO, or without a network allow list. - crates.io (Rust): 1 critical advisory ( qdrant ). Check with cargo audit . - Maven: 1 critical advisory ( org.silverpeas.core:silverpeas-core ). Check with mvn dependency:tree -Dincludes=: . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Editorial briefs - **Check exposure** [Snowflake UNC5537: Customer Accounts Hit With Stolen Logins](https://erroneo.us/security/briefs/snowflake-unc5537-customer-account-breaches/index.md): There was no Snowflake bug to patch; the lesson is that any cloud data platform reachable with a password alone will eventually be logged into by someone holding an infostealer log. ## Known exploited (CISA KEV) None. ## Critical advisories - [CVE-2024-3584](https://erroneo.us/security/cve/CVE-2024-3584/index.md) qdrant is vulnerable to path traversal due to improper input validation in the `/collections/{name}/snapshots/upload` endpoint — crates.io (Rust) qdrant = 1.9.0-dev → 1.9.0 - [CVE-2024-36042](https://erroneo.us/security/cve/CVE-2024-36042/index.md) Silverpeas authentication bypass — Maven org.silverpeas.core:silverpeas-core < 6.3.5 → 6.3.5 --- Source page: https://erroneo.us/security/2024-06-02/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt