Digest · Wednesday
Security digest: November 6, 2024
3 critical advisories.
All digests · RSS · Markdown
Take stock
- PyPI: 2 critical advisories (
codechecker). Check withpip-audit (or: pip show <package>). - npm: 1 critical advisory (
happy-dom). Check withnpm audit (or: npm ls <package>). - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 0
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
None.
Critical advisories by ecosystem 3
GitHub-reviewed advisories rated critical, published this day (Pacific time).
PyPI 2
Check: pip-audit (or: pip show <package>)
- codechecker authentication method confusion vulnerability allows logging in as the built-in root user from an external service CVE-2024-10082 CVSS 9.4 Critical
codechecker<= 6.24.1 → fixed in 6.24.2 - codechecker vulnerable to authentication bypass when using specifically crafted URLs CVE-2024-10081 CVSS 9.9 Critical
codechecker< 6.24.2 → fixed in 6.24.2
npm 1
Check: npm audit (or: npm ls <package>)
- happy-dom allows for server side code to be executed by a <script> tag CVE-2024-51757 CVSS 9.3 Critical
happy-dom< 15.10.2 → fixed in 15.10.2