--- title: "Security digest: February 24, 2025" url: https://erroneo.us/security/2025-02-24/ description: "February 24, 2025 vulnerability digest: 2 CISA KEV additions (Adobe, Oracle); 2 critical advisories (Go). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2025-02-24 date_modified: 2025-02-24 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: February 24, 2025 2 known exploited (cisa kev) additions and 2 critical advisories. ## Take stock - Do you run any of these? Oracle Agile Product Lifecycle Management (PLM), Adobe ColdFusion. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-03-17. - Go: 2 critical advisories ( github.com/mattermost/mattermost/server/v8 ). Check with govulncheck ./... . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) - [CVE-2024-20953](https://erroneo.us/security/cve/CVE-2024-20953/index.md) Oracle Agile Product Lifecycle Management (PLM): Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability (CISA due 2025-03-17) - [CVE-2017-3066](https://erroneo.us/security/cve/CVE-2017-3066/index.md) Adobe ColdFusion: Adobe ColdFusion Deserialization Vulnerability (CISA due 2025-03-17) ## Critical advisories - [CVE-2025-20051](https://erroneo.us/security/cve/CVE-2025-20051/index.md) Mattermost allows reading arbitrary files — Go github.com/mattermost/mattermost/server/v8 < 8.0.0-20250122165010-4ed702ccff4e → 8.0.0-20250122165010-4ed702ccff4e; Go github.com/mattermost/mattermost/server/v8 >= 9.11.0-rc1, < 9.11.8 → 9.11.8; Go github.com/mattermost/mattermost/server/v8 >= 10.2.0-rc1, < 10.2.3 → 10.2.3 - [CVE-2025-25279](https://erroneo.us/security/cve/CVE-2025-25279/index.md) Mattermost allows reading arbitrary files related to importing boards — Go github.com/mattermost/mattermost/server/v8 < 8.0.0-20250122165010-4ed702ccff4e → 8.0.0-20250122165010-4ed702ccff4e; Go github.com/mattermost/mattermost/server/v8 >= 9.11.0-rc1, < 9.11.8 → 9.11.8; Go github.com/mattermost/mattermost/server/v8 >= 10.2.0-rc1, < 10.2.3 → 10.2.3 --- Source page: https://erroneo.us/security/2025-02-24/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt