--- title: "Security digest: October 25, 2024" url: https://erroneo.us/security/2024-10-25/ description: "October 25, 2024 vulnerability digest: 4 critical advisories (Go). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2024-10-25 date_modified: 2024-10-25 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: October 25, 2024 4 critical advisories. ## Take stock - Go: 4 critical advisories ( github.com/rancher/rke2 , github.com/rancher/rancher , github.com/crossplane/crossplane ). Check with govulncheck ./... . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) None. ## Critical advisories - [GHSA-x7xj-jvwp-97rv](https://erroneo.us/security/ghsa/GHSA-x7xj-jvwp-97rv/index.md) RKE2 allows privilege escalation in Windows nodes due to Insecure Access Control Lists — Go github.com/rancher/rke2 >= 1.27.0, < 1.27.15 → 1.27.15; Go github.com/rancher/rke2 >= 1.28.0, < 1.28.11 → 1.28.11; Go github.com/rancher/rke2 >= 1.29.0, < 1.29.6 → 1.29.6 - [CVE-2024-22036](https://erroneo.us/security/cve/CVE-2024-22036/index.md) Rancher Remote Code Execution via Cluster/Node Drivers — Go github.com/rancher/rancher >= 2.7.0, < 2.7.16 → 2.7.16; Go github.com/rancher/rancher >= 2.8.0, < 2.8.9 → 2.8.9; Go github.com/rancher/rancher >= 2.9.0, < 2.9.3 → 2.9.3 - [CVE-2023-32197](https://erroneo.us/security/cve/CVE-2023-32197/index.md) Rancher allows privilege escalation in Windows nodes due to Insecure Access Control Lists — Go github.com/rancher/rancher >= 2.7.0, < 2.8.9 → 2.8.9; Go github.com/rancher/rancher >= 2.9.0, < 2.9.3 → 2.9.3 - [GHSA-7h65-4p22-39j6](https://erroneo.us/security/ghsa/GHSA-7h65-4p22-39j6/index.md) github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses — Go github.com/crossplane/crossplane = 1.15.5 → 1.15.6; Go github.com/crossplane/crossplane = 1.16.2 → 1.16.3; Go github.com/crossplane/crossplane = 1.17.1 → 1.17.2 --- Source page: https://erroneo.us/security/2024-10-25/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt