Digest · Thursday
Security digest: September 19, 2024
1 known exploited (cisa kev) addition and 3 critical advisories.
All digests · RSS · Markdown
Take stock
- Do you run any of these? Ivanti Cloud Services Appliance (CSA). They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2024-10-10.
- Go: 3 critical advisories (
github.com/grafana/grafana-plugin-sdk-go,d7y.io/dragonfly/v2,github.com/traefik/traefik/v3,github.com/traefik/traefik/v2,github.com/traefik/traefik). Check withgovulncheck ./.... - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 1
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
| CVE | Product and flaw | CISA due |
|---|---|---|
| CVE-2024-8963 | Ivanti Cloud Services Appliance (CSA) Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability | 2024-10-10 |
Critical advisories by ecosystem 3
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Go 3
Check: govulncheck ./...
- Grafana plugin SDK Information Leakage CVE-2024-8986 CVSS 9.1 Critical
github.com/grafana/grafana-plugin-sdk-go<= 0.249.0 → fixed in 0.250.0 - Dragonfly2 has hard coded cyptographic key CVE-2023-27584 CVSS 9.3 Critical
d7y.io/dragonfly/v2>= 2.1.0-alpha.0, < 2.1.0-beta.1 → fixed in 2.1.0-beta.1;d7y.io/dragonfly/v2< 2.0.9-rc.2 → fixed in 2.0.9-rc.2 - HTTP client can manipulate custom HTTP headers that are added by Traefik CVE-2024-45410 CVSS 9.3 Critical
github.com/traefik/traefik/v3>= 3.0.0-beta3, < 3.1.3 → fixed in 3.1.3;github.com/traefik/traefik/v2< 2.11.9 → fixed in 2.11.9;github.com/traefik/traefik< 2.11.9 → fixed in 2.11.9