erroneo.us
Search all guides⌘K

Digest · Monday

Security digest: August 5, 2024

1 editorial brief, 1 known exploited (cisa kev) addition and 7 critical advisories.

All digests · RSS · Markdown

Take stock

  • Act now: Apache OFBiz: Unauthenticated RCE (CVE-2024-38856). Anyone running Apache OFBiz 18.12.15 or earlier, or a product built on OFBiz, especially with the web interface reachable from untrusted networks.
  • Do you run any of these? Microsoft Windows. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2024-08-26.
  • Go: 3 critical advisories (github.com/IceWhaleTech/CasaOS, code.gitea.io/gitea, github.com/rudderlabs/rudder-server). Check with govulncheck ./....
  • npm: 2 critical advisories (nuxt, nextchat). Check with npm audit (or: npm ls <package>).
  • Maven: 2 critical advisories (com.xuxueli:xxl-rpc-core, org.redisson:redisson). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

· Vulnerability · CVE-2024-38856

Apache OFBiz: Unauthenticated RCE (CVE-2024-38856)

Any internet-reachable OFBiz older than 18.12.16 should be treated as compromised-until-proven-otherwise and upgraded immediately; this bug class has been exploited repeatedly.

Must act: Anyone running Apache OFBiz 18.12.15 or earlier, or a product built on OFBiz, especially with the web interface reachable from untrusted networks.

Can relax: Teams that do not run OFBiz or an OFBiz-derived product, and those already on a current OFBiz release.

  1. Upgrade to the latest OFBiz release listed on ofbiz.apache.org (18.12.16 at minimum)
  2. If you cannot upgrade today, take the OFBiz web interface off the internet or put it behind a VPN or authenticating proxy
  3. Block requests to ProgramExport and similar admin views via unauthenticated controllers at your reverse proxy as a stopgap

Read the brief →

Known exploited (CISA KEV) 1

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2018-0824Microsoft Windows
Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability		2024-08-26

Critical advisories by ecosystem 7

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Go 3

Check: govulncheck ./...

Maven 2

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

npm 2

Check: npm audit (or: npm ls <package>)