Digest · Thursday
Security digest: March 6, 2025
1 critical advisory.
All digests · RSS · Markdown
Take stock
- Go: 1 critical advisory (
github.com/fleetdm/fleet/v4). Check withgovulncheck ./.... - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 0
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
None.
Critical advisories by ecosystem 1
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Go 1
Check: govulncheck ./...
- Fleet has SAML authentication vulnerability due to improper SAML response validation CVE-2025-27509 CVSS 9.3 Critical
github.com/fleetdm/fleet/v4>= 4.64.0, < 4.64.2 → fixed in 4.64.2;github.com/fleetdm/fleet/v4>= 4.63.0, < 4.63.2 → fixed in 4.63.2;github.com/fleetdm/fleet/v4>= 4.62.0, < 4.62.4 → fixed in 4.62.4; +2 more packages