---
title: "Security digest: July 1, 2024"
url: https://erroneo.us/security/2024-07-01/
description: "July 1, 2024 vulnerability digest: 1 brief (regreSSHion); 3 critical advisories (npm, Go, Maven). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2024-07-01
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: July 1, 2024

1 editorial brief and 3 critical advisories.

## Take stock

- Patch this week: regreSSHion . Owners of glibc-based Linux hosts running OpenSSH 8.5p1 through 9.7p1 (for example Ubuntu 22.04/24.04, RHEL 9) with sshd reachable from untrusted networks, above all 32-bit systems or builds without per-connection ASLR re-randomization.
- npm: 1 critical advisory ( parse-server ). Check with npm audit (or: npm ls <package>) .
- Go: 1 critical advisory ( github.com/gofiber/fiber , github.com/gofiber/fiber/v2 , github.com/gofiber/fiber/v2/middleware/session ). Check with govulncheck ./... .
- Maven: 1 critical advisory ( org.geoserver.web:gs-web-app , org.geoserver:gs-wfs , org.geoserver:gs-wms ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Patch this week** [regreSSHion: OpenSSH sshd Signal Race RCE (CVE-2024-6387)](https://erroneo.us/security/briefs/regresshion-openssh-signal-race-cve-2024-6387/index.md): Serious on paper (unauthenticated root RCE in sshd), but the only demonstrated exploit needed a 32-bit glibc target and 6-8 hours of continuous connections in a lab, so patch promptly through your distro instead of panicking.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2024-39309](https://erroneo.us/security/cve/CVE-2024-39309/index.md) ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability — npm parse-server < 6.5.7 → 6.5.7; npm parse-server >= 7.0.0, < 7.1.0 → 7.1.0
- [CVE-2024-38513](https://erroneo.us/security/cve/CVE-2024-38513/index.md) Session Middleware Token Injection Vulnerability — Go github.com/gofiber/fiber <= 2.52.4 → 2.52.5; Go github.com/gofiber/fiber/v2 <= 2.52.4 → 2.52.5; Go github.com/gofiber/fiber/v2/middleware/session <= 2.52.4 → 2.52.5
- [CVE-2024-36401](https://erroneo.us/security/cve/CVE-2024-36401/index.md) Remote Code Execution (RCE) vulnerability in geoserver — Maven org.geoserver.web:gs-web-app >= 2.24.0, < 2.24.4 → 2.24.4; Maven org.geoserver:gs-wfs >= 2.24.0, < 2.24.4 → 2.24.4; Maven org.geoserver:gs-wms >= 2.24.0, < 2.24.4 → 2.24.4

---
Source page: https://erroneo.us/security/2024-07-01/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt