Digest · Thursday
Security digest: October 24, 2024
2 known exploited (cisa kev) additions and 1 critical advisory.
All digests · RSS · Markdown
Take stock
- Do you run any of these? Roundcube Webmail, Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD). They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2024-11-14.
- Maven: 1 critical advisory (
org.openrefine.dependencies:butterfly). Check withmvn dependency:tree -Dincludes=<groupId>:<artifactId>. - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 2
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
| CVE | Product and flaw | CISA due |
|---|---|---|
| CVE-2024-37383 | Roundcube Webmail RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability | 2024-11-14 |
| CVE-2024-20481 | Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Cisco ASA and FTD Denial-of-Service Vulnerability | 2024-11-14 |
Critical advisories by ecosystem 1
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Maven 1
Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>
- Butterfly has path/URL confusion in resource handling leading to multiple weaknesses CVE-2024-47883 CVSS 9.1 Critical
org.openrefine.dependencies:butterfly< 1.2.6 → fixed in 1.2.6