---
title: "Security digest: September 19, 2024"
url: https://erroneo.us/security/2024-09-19/
description: "September 19, 2024 vulnerability digest: 1 CISA KEV addition (Ivanti); 3 critical advisories (Go). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2024-09-19
date_modified: 2024-09-19
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: September 19, 2024

1 known exploited (cisa kev) addition and 3 critical advisories.

## Take stock

- Do you run any of these? Ivanti Cloud Services Appliance (CSA). They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2024-10-10.
- Go: 3 critical advisories ( github.com/grafana/grafana-plugin-sdk-go , d7y.io/dragonfly/v2 , github.com/traefik/traefik/v3 , github.com/traefik/traefik/v2 , github.com/traefik/traefik ). Check with govulncheck ./... .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2024-8963](https://erroneo.us/security/cve/CVE-2024-8963/index.md) Ivanti Cloud Services Appliance (CSA): Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability (CISA due 2024-10-10)

## Critical advisories

- [CVE-2024-8986](https://erroneo.us/security/cve/CVE-2024-8986/index.md) Grafana plugin SDK Information Leakage — Go github.com/grafana/grafana-plugin-sdk-go <= 0.249.0 → 0.250.0
- [CVE-2023-27584](https://erroneo.us/security/cve/CVE-2023-27584/index.md) Dragonfly2 has hard coded cyptographic key — Go d7y.io/dragonfly/v2 >= 2.1.0-alpha.0, < 2.1.0-beta.1 → 2.1.0-beta.1; Go d7y.io/dragonfly/v2 < 2.0.9-rc.2 → 2.0.9-rc.2
- [CVE-2024-45410](https://erroneo.us/security/cve/CVE-2024-45410/index.md) HTTP client can manipulate custom HTTP headers that are added by Traefik — Go github.com/traefik/traefik/v3 >= 3.0.0-beta3, < 3.1.3 → 3.1.3; Go github.com/traefik/traefik/v2 < 2.11.9 → 2.11.9; Go github.com/traefik/traefik < 2.11.9 → 2.11.9

---
Source page: https://erroneo.us/security/2024-09-19/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt