Digest · Monday
Security digest: December 23, 2024
1 known exploited (cisa kev) addition and 3 critical advisories.
All digests · RSS · Markdown
Take stock
- Do you run any of these? Acclaim Systems USAHERDS. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-01-13.
- Go: 3 critical advisories (
gogs.io/gogs). Check withgovulncheck ./.... - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 1
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
| CVE | Product and flaw | CISA due |
|---|---|---|
| CVE-2021-44207 | Acclaim Systems USAHERDS Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability | 2025-01-13 |
Critical advisories by ecosystem 3
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Go 3
Check: govulncheck ./...
- Gogs has an argument Injection in the built-in SSH server CVE-2024-39930 CVSS 9.9 Critical
gogs.io/gogs<= 0.13.0 → fixed in 0.13.1 - Gogs allows deletion of internal files CVE-2024-39931 CVSS 9.9 Critical
gogs.io/gogs<= 0.13.0 → fixed in 0.13.1 - Gogs allows argument injection during the previewing of changes CVE-2024-39932 CVSS 9.9 Critical
gogs.io/gogs<= 0.13.0 → fixed in 0.13.1