--- title: "Security digest: January 14, 2025" url: https://erroneo.us/security/2025-01-14/ description: "January 14, 2025 vulnerability digest: 2 briefs (rsync: Six Flaws Incl. Daemon Heap Overflow…); 4 CISA KEV additions (Fortinet, Microsoft); 4 critical…" type: security-digest-day section: "Security Digest" date_published: 2025-01-14 date_modified: 2026-10-21 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: January 14, 2025 2 editorial briefs, 4 known exploited (cisa kev) additions and 4 critical advisories. ## Take stock - Check exposure: rsync: Six Flaws Incl. Daemon Heap Overflow (CVE-2024-12084) . Operators of rsync daemons (rsyncd, TCP 873), especially public mirrors with anonymous read access, and anyone who pulls from untrusted rsync servers. - Check exposure: FortiOS 7.0 Websocket Auth Bypass to Super-Admin . Owners of FortiGate on FortiOS 7.0.0-7.0.16 or FortiProxy 7.0.0-7.0.19 / 7.2.0-7.2.12 whose HTTP/HTTPS management interface was reachable from the internet. - Do you run any of these? Microsoft Windows, Fortinet FortiOS and FortiProxy. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-01-21. - PyPI: 2 critical advisories ( gradio , rasa-pro , rasa ). Check with pip-audit (or: pip show ) . - npm: 1 critical advisory ( mongoose ). Check with npm audit (or: npm ls ) . - Maven: 1 critical advisory ( org.xwiki.platform:xwiki-platform-realtime-wysiwyg-ui ). Check with mvn dependency:tree -Dincludes=: . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Editorial briefs - **Check exposure** [rsync: Six Flaws Incl. Daemon Heap Overflow (CVE-2024-12084)](https://erroneo.us/security/briefs/rsync-heap-overflow-cve-2024-12084/index.md): Distros shipped fixes in January 2025 and there is no known exploitation, but internet-facing rsync daemons have since needed two more security releases, so verify you run a current rsync rather than just 3.4.0. - **Check exposure** [FortiOS 7.0 Websocket Auth Bypass to Super-Admin](https://erroneo.us/security/briefs/fortios-websocket-auth-bypass-cve-2024-55591/index.md): Exploited as a zero-day in late 2024 and patched in January 2025; anyone whose FortiOS 7.0 admin interface was internet-facing back then should audit admin and VPN accounts, not just the firmware version. ## Known exploited (CISA KEV) - [CVE-2025-21335](https://erroneo.us/security/cve/CVE-2025-21335/index.md) Microsoft Windows: Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability (CISA due 2025-02-04) - [CVE-2025-21334](https://erroneo.us/security/cve/CVE-2025-21334/index.md) Microsoft Windows: Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability (CISA due 2025-02-04) - [CVE-2025-21333](https://erroneo.us/security/cve/CVE-2025-21333/index.md) Microsoft Windows: Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow Vulnerability (CISA due 2025-02-04) - [CVE-2024-55591](https://erroneo.us/security/cve/CVE-2024-55591/index.md) Fortinet FortiOS and FortiProxy: Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability (CISA due 2025-01-21) ## Critical advisories - [CVE-2025-23061](https://erroneo.us/security/cve/CVE-2025-23061/index.md) Mongoose search injection vulnerability — npm mongoose >= 8.0.0-rc0, < 8.9.5 → 8.9.5; npm mongoose >= 7.0.0-rc0, < 7.8.4 → 7.8.4; npm mongoose < 6.13.6 → 6.13.6 - [CVE-2025-23025](https://erroneo.us/security/cve/CVE-2025-23025/index.md) XWiki Realtime WYSIWYG Editor extension allows privilege escalation (PR) through realtime WYSIWYG editing — Maven org.xwiki.platform:xwiki-platform-realtime-wysiwyg-ui >= 13.9-rc-1, < 15.10.12 → 15.10.12; Maven org.xwiki.platform:xwiki-platform-realtime-wysiwyg-ui >= 16.0.0-rc-1, < 16.4.1 → 16.4.1; Maven org.xwiki.platform:xwiki-platform-realtime-wysiwyg-ui >= 16.5.0-rc-1, < 16.6.0-rc-1 → 16.6.0-rc-1 - [CVE-2025-23042](https://erroneo.us/security/cve/CVE-2025-23042/index.md) Gradio Blocked Path ACL Bypass Vulnerability — PyPI gradio < 5.11.0 → 5.11.0 - [CVE-2024-49375](https://erroneo.us/security/cve/CVE-2024-49375/index.md) Rasa Allows Remote Code Execution via Remote Model Loading — PyPI rasa-pro >= 3.10.0, < 3.10.12 → 3.10.12; PyPI rasa-pro >= 3.9.0, < 3.9.16 → 3.9.16; PyPI rasa-pro < 3.8.18 → 3.8.18 --- Source page: https://erroneo.us/security/2025-01-14/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt