Digest · Wednesday
Security digest: September 11, 2024
2 critical advisories.
All digests · RSS · Markdown
Take stock
- PyPI: 1 critical advisory (
agpt). Check withpip-audit (or: pip show <package>). - RubyGems: 1 critical advisory (
omniauth-saml). Check withbundle audit check --update. - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 0
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
None.
Critical advisories by ecosystem 2
GitHub-reviewed advisories rated critical, published this day (Pacific time).
PyPI 1
Check: pip-audit (or: pip show <package>)
- AutoGPT bypass of the shell commands denylist settings CVE-2024-6091 CVSS 9.3 Critical
agpt<= 0.5.1 → no fix listed
RubyGems 1
Check: bundle audit check --update
- omniauth-saml vulnerable to Improper Verification of Cryptographic Signature GHSA-cvp8-5r8g-fhvq CVSS 9.9 Critical
omniauth-saml>= 2.0.0, < 2.1.2 → fixed in 2.1.2;omniauth-saml< 1.10.5 → fixed in 1.10.5;omniauth-saml>= 2.2.0, < 2.2.1 → fixed in 2.2.1