--- title: "Security digest: October 11, 2024" url: https://erroneo.us/security/2024-10-11/ description: "October 11, 2024 vulnerability digest: 4 critical advisories (npm, Maven, Go). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2024-10-11 date_modified: 2024-10-11 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: October 11, 2024 4 critical advisories. ## Take stock - npm: 2 critical advisories ( angular-base64-upload , jsonpath-plus ). Check with npm audit (or: npm ls ) . - Maven: 2 critical advisories ( org.webjars.npm:jsonpath-plus , org.pac4j:pac4j-core ). Check with mvn dependency:tree -Dincludes=: . - Go: 1 critical advisory ( github.com/ssoready/ssoready ). Check with govulncheck ./... . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) None. ## Critical advisories - [CVE-2024-42640](https://erroneo.us/security/cve/CVE-2024-42640/index.md) angular-base64-upload vulnerable to unauthenticated remote code execution — npm angular-base64-upload < 0.1.21 → 0.1.21 - [CVE-2024-21534](https://erroneo.us/security/cve/CVE-2024-21534/index.md) JSONPath Plus Remote Code Execution (RCE) Vulnerability — Maven org.webjars.npm:jsonpath-plus <= 6.0.1 → no fix; npm jsonpath-plus < 10.2.0 → 10.2.0 - [CVE-2024-47832](https://erroneo.us/security/cve/CVE-2024-47832/index.md) SSOReady has an XML Signature Bypass via differential XML parsing — Go github.com/ssoready/ssoready < 0.0.0-20241009153838-7f92a0630439 → 0.0.0-20241009153838-7f92a0630439 - [CVE-2023-25581](https://erroneo.us/security/cve/CVE-2023-25581/index.md) pac4j-core affected by a Java deserialization vulnerability — Maven org.pac4j:pac4j-core < 4.0.0 → 4.0.0 --- Source page: https://erroneo.us/security/2024-10-11/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt