--- title: "Security digest: September 17, 2024" url: https://erroneo.us/security/2024-09-17/ description: "September 17, 2024 vulnerability digest: 4 CISA KEV additions (Adobe); 1 critical advisory (Maven). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2024-09-17 date_modified: 2024-09-17 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: September 17, 2024 4 known exploited (cisa kev) additions and 1 critical advisory. ## Take stock - Do you run any of these? Adobe Flash Player. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2024-10-08. - Maven: 1 critical advisory ( pl.allegro.tech.hermes:hermes-management ). Check with mvn dependency:tree -Dincludes=: . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) - [CVE-2014-0502](https://erroneo.us/security/cve/CVE-2014-0502/index.md) Adobe Flash Player: Adobe Flash Player Double Free Vulnerablity (CISA due 2024-10-08) - [CVE-2014-0497](https://erroneo.us/security/cve/CVE-2014-0497/index.md) Adobe Flash Player: Adobe Flash Player Integer Underflow Vulnerablity (CISA due 2024-10-08) - [CVE-2013-0648](https://erroneo.us/security/cve/CVE-2013-0648/index.md) Adobe Flash Player: Adobe Flash Player Code Execution Vulnerability (CISA due 2024-10-08) - [CVE-2013-0643](https://erroneo.us/security/cve/CVE-2013-0643/index.md) Adobe Flash Player: Adobe Flash Player Incorrect Default Permissions Vulnerability (CISA due 2024-10-08) ## Critical advisories - [GHSA-2gh6-wc3m-g37f](https://erroneo.us/security/ghsa/GHSA-2gh6-wc3m-g37f/index.md) hermes-management is vulnerable to RCE due to Apache commons-jxpath — Maven pl.allegro.tech.hermes:hermes-management >= 0.8.2, < 2.2.9 → 2.2.9 --- Source page: https://erroneo.us/security/2024-09-17/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt