Digest · Thursday
Security digest: August 22, 2024
2 critical advisories.
All digests · RSS · Markdown
Take stock
- Go: 1 critical advisory (
goauthentik.io). Check withgovulncheck ./.... - PyPI: 1 critical advisory (
llama-index-core). Check withpip-audit (or: pip show <package>). - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 0
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
None.
Critical advisories by ecosystem 2
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Go 1
Check: govulncheck ./...
- GoAuthentik vulnerable to Insufficient Authorization for several API endpoints CVE-2024-42490 CVSS 9.1 Critical
goauthentik.io>= 2024.6.0-rc1, < 2024.6.4 → fixed in 2024.6.4;goauthentik.io< 2024.4.4 → fixed in 2024.4.4
PyPI 1
Check: pip-audit (or: pip show <package>)
- LlamaIndex includes an exec call for `import {cls_name}` CVE-2024-45201 CVSS 9.3 Critical
llama-index-core< 0.10.38 → fixed in 0.10.38