erroneo.us
Search all guides⌘K

Digest · Monday

Security digest: July 22, 2024

1 critical advisory.

All digests · RSS · Markdown

Take stock

  • NuGet: 1 critical advisory (Csla). Check with dotnet list package --vulnerable --include-transitive.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 1

GitHub-reviewed advisories rated critical, published this day (Pacific time).

NuGet 1

Check: dotnet list package --vulnerable --include-transitive

  • CLSA Directory Traversal vulnerability CVE-2024-28698 CVSS 9.3 Critical
    Csla < 5.5.4 → fixed in 5.5.4; Csla >= 6.0.0, <= 6.2.2 → fixed in 8.0.0; Csla >= 7.0.0, <= 7.0.5 → fixed in 8.0.0