erroneo.us
Search all guides⌘K

Digest · Monday

Security digest: July 1, 2024

1 editorial brief and 3 critical advisories.

All digests · RSS · Markdown

Take stock

  • Patch this week: regreSSHion. Owners of glibc-based Linux hosts running OpenSSH 8.5p1 through 9.7p1 (for example Ubuntu 22.04/24.04, RHEL 9) with sshd reachable from untrusted networks, above all 32-bit systems or builds without per-connection ASLR re-randomization.
  • npm: 1 critical advisory (parse-server). Check with npm audit (or: npm ls <package>).
  • Go: 1 critical advisory (github.com/gofiber/fiber, github.com/gofiber/fiber/v2, github.com/gofiber/fiber/v2/middleware/session). Check with govulncheck ./....
  • Maven: 1 critical advisory (org.geoserver.web:gs-web-app, org.geoserver:gs-wfs, org.geoserver:gs-wms). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Patch this week

· Vulnerability · CVE-2024-6387

regreSSHion: OpenSSH sshd Signal Race RCE (CVE-2024-6387)

Serious on paper (unauthenticated root RCE in sshd), but the only demonstrated exploit needed a 32-bit glibc target and 6-8 hours of continuous connections in a lab, so patch promptly through your distro instead of panicking.

Must act: Owners of glibc-based Linux hosts running OpenSSH 8.5p1 through 9.7p1 (for example Ubuntu 22.04/24.04, RHEL 9) with sshd reachable from untrusted networks, above all 32-bit systems or builds without per-connection ASLR re-randomization.

Can relax: OpenBSD, OpenSSH 4.4p1 through 8.4p1 (e.g. RHEL 8, Ubuntu 20.04), Windows OpenSSH per Qualys, and hosts whose sshd is reachable only from a trusted network or bastion.

  1. Check the installed version with `ssh -V` and your package manager (`dpkg -l openssh-server` / `rpm -q openssh-server`)
  2. Install your distribution's patched openssh-server and restart sshd
  3. Restrict sshd to VPN, bastion or allow-listed IPs; do not leave port 22 open to the world

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 3

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Go 1

Check: govulncheck ./...

  • Session Middleware Token Injection Vulnerability CVE-2024-38513 CVSS 10.0 Critical
    github.com/gofiber/fiber <= 2.52.4 → fixed in 2.52.5; github.com/gofiber/fiber/v2 <= 2.52.4 → fixed in 2.52.5; github.com/gofiber/fiber/v2/middleware/session <= 2.52.4 → fixed in 2.52.5

Maven 1

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

  • Remote Code Execution (RCE) vulnerability in geoserver CVE-2024-36401 CVSS 9.3 Critical
    org.geoserver.web:gs-web-app >= 2.24.0, < 2.24.4 → fixed in 2.24.4; org.geoserver:gs-wfs >= 2.24.0, < 2.24.4 → fixed in 2.24.4; org.geoserver:gs-wms >= 2.24.0, < 2.24.4 → fixed in 2.24.4; +9 more packages

npm 1

Check: npm audit (or: npm ls <package>)