Digest · Thursday
Security digest: July 18, 2024
2 critical advisories.
All digests · RSS · Markdown
Take stock
- PyPI: 1 critical advisory (
torchserve). Check withpip-audit (or: pip show <package>). - Go: 1 critical advisory (
github.com/1Panel-dev/1Panel). Check withgovulncheck ./.... - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 0
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
None.
Critical advisories by ecosystem 2
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Go 1
Check: govulncheck ./...
- 1Panel has an SQL injection issue related to the orderBy clause CVE-2024-39907 CVSS 9.3 Critical
github.com/1Panel-dev/1Panel< 1.10.12-tls → fixed in 1.10.12-tls
PyPI 1
Check: pip-audit (or: pip show <package>)
- TorchServe vulnerable to bypass of allowed_urls configuration CVE-2024-35198 CVSS 9.3 Critical
torchserve< 0.11.0 → fixed in 0.11.0