erroneo.us
Search all guides⌘K

Digest · Tuesday

Security digest: January 14, 2025

2 editorial briefs, 4 known exploited (cisa kev) additions and 4 critical advisories.

All digests · RSS · Markdown

Take stock

  • Check exposure: rsync: Six Flaws Incl. Daemon Heap Overflow (CVE-2024-12084). Operators of rsync daemons (rsyncd, TCP 873), especially public mirrors with anonymous read access, and anyone who pulls from untrusted rsync servers.
  • Check exposure: FortiOS 7.0 Websocket Auth Bypass to Super-Admin. Owners of FortiGate on FortiOS 7.0.0-7.0.16 or FortiProxy 7.0.0-7.0.19 / 7.2.0-7.2.12 whose HTTP/HTTPS management interface was reachable from the internet.
  • Do you run any of these? Microsoft Windows, Fortinet FortiOS and FortiProxy. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-01-21.
  • PyPI: 2 critical advisories (gradio, rasa-pro, rasa). Check with pip-audit (or: pip show <package>).
  • npm: 1 critical advisory (mongoose). Check with npm audit (or: npm ls <package>).
  • Maven: 1 critical advisory (org.xwiki.platform:xwiki-platform-realtime-wysiwyg-ui). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2024-12084, CVE-2024-12085

rsync: Six Flaws Incl. Daemon Heap Overflow (CVE-2024-12084)

Distros shipped fixes in January 2025 and there is no known exploitation, but internet-facing rsync daemons have since needed two more security releases, so verify you run a current rsync rather than just 3.4.0.

Must act: Operators of rsync daemons (rsyncd, TCP 873), especially public mirrors with anonymous read access, and anyone who pulls from untrusted rsync servers.

Can relax: Hosts that only use rsync over SSH between machines you control, with distro-patched packages, face little practical risk from this set.

  1. Check versions with rsync --version (3.4.0+ reports protocol version 32) or your package manager, on servers, containers and appliances.
  2. Update to your distro's patched rsync package, or upstream 3.5.1, which also includes the later 2026 security releases.
  3. If a daemon cannot be updated immediately, rebuild with -DDISABLE_SHA512_DIGEST and -DDISABLE_SHA256_DIGEST (mitigates CVE-2024-12084) and -ftrivial-auto-var-init=zero (CVE-2024-12085), or firewall TCP 873 to trusted clients.

Read the brief →

Check exposure

· Vulnerability · CVE-2024-55591, CVE-2025-24472

FortiOS 7.0 Websocket Auth Bypass to Super-Admin

Exploited as a zero-day in late 2024 and patched in January 2025; anyone whose FortiOS 7.0 admin interface was internet-facing back then should audit admin and VPN accounts, not just the firmware version.

Must act: Owners of FortiGate on FortiOS 7.0.0-7.0.16 or FortiProxy 7.0.0-7.0.19 / 7.2.0-7.2.12 whose HTTP/HTTPS management interface was reachable from the internet.

Can relax: FortiOS 6.4, 7.2, 7.4 and 7.6 users (not affected), and 7.0 users who restricted management access to trusted networks and upgraded to 7.0.17 or later.

  1. Confirm firmware with get system status; upgrade FortiOS 7.0 to 7.0.17 or later (or migrate to a supported newer branch) and FortiProxy to 7.0.20 / 7.2.13 or later.
  2. Disable the HTTP/HTTPS admin interface on WAN, or restrict it with local-in policies to a management address group.
  3. Audit config system admin and local users for unknown super_admin accounts, unexpected SSL VPN group members and new SSL VPN portals.

Read the brief →

Known exploited (CISA KEV) 4

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2025-21335Microsoft Windows
Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability		2025-02-04
CVE-2025-21334Microsoft Windows
Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability		2025-02-04
CVE-2025-21333Microsoft Windows
Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow Vulnerability		2025-02-04
CVE-2024-55591Fortinet FortiOS and FortiProxy
Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability Ransomware		2025-01-21

Critical advisories by ecosystem 4

GitHub-reviewed advisories rated critical, published this day (Pacific time).

PyPI 2

Check: pip-audit (or: pip show <package>)

Maven 1

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

npm 1

Check: npm audit (or: npm ls <package>)

  • Mongoose search injection vulnerability CVE-2025-23061 CVSS 9.0 Critical
    mongoose >= 8.0.0-rc0, < 8.9.5 → fixed in 8.9.5; mongoose >= 7.0.0-rc0, < 7.8.4 → fixed in 7.8.4; mongoose < 6.13.6 → fixed in 6.13.6