--- title: "Security digest: June 24, 2024" url: https://erroneo.us/security/2024-06-24/ description: "June 24, 2024 vulnerability digest: 1 brief (Probllama); 2 critical advisories (Maven). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2024-06-24 date_modified: 2026-10-21 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: June 24, 2024 1 editorial brief and 2 critical advisories. ## Take stock - Check exposure: Probllama . Anyone running Ollama older than 0.1.34, and anyone whose Ollama API (port 11434) is reachable from outside the host, especially Docker deployments, which listen on 0.0.0.0 and run as root by default. - Maven: 2 critical advisories ( org.xwiki.platform:xwiki-platform-rendering-macro-include , org.apache.streampipes:streampipes-resource-management ). Check with mvn dependency:tree -Dincludes=: . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Editorial briefs - **Check exposure** [Probllama: Ollama Path Traversal to RCE (CVE-2024-37032)](https://erroneo.us/security/briefs/ollama-probllama-path-traversal-rce-cve-2024-37032/index.md): The bug was fixed in May 2024, so anything current is patched; the lasting risk is Ollama servers left reachable from the internet with no authentication, which is still very common. ## Known exploited (CISA KEV) None. ## Critical advisories - [CVE-2024-38369](https://erroneo.us/security/cve/CVE-2024-38369/index.md) XWiki programming rights may be inherited by inclusion — Maven org.xwiki.platform:xwiki-platform-rendering-macro-include < 15.0-rc-1 → 15.0-rc-1 - [CVE-2024-29868](https://erroneo.us/security/cve/CVE-2024-29868/index.md) Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generation — Maven org.apache.streampipes:streampipes-resource-management >= 0.69.0, < 0.95.0 → 0.95.0 --- Source page: https://erroneo.us/security/2024-06-24/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt