---
title: "Security digest: March 24, 2025"
url: https://erroneo.us/security/2025-03-24/
description: "March 24, 2025 vulnerability digest: 1 brief (IngressNightmare); 1 CISA KEV addition (reviewdog); 2 critical advisories (Maven, Go). What to patch and who…"
type: security-digest-day
section: "Security Digest"
date_published: 2025-03-24
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: March 24, 2025

1 editorial brief, 1 known exploited (cisa kev) addition and 2 critical advisories.

## Take stock

- Check exposure: IngressNightmare . Anyone running the Kubernetes community ingress-nginx controller older than v1.11.5 or v1.12.1 with the validating admission webhook enabled, especially if the webhook is reachable beyond the API server.
- Do you run any of these? reviewdog action-setup GitHub Action. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-04-14.
- Maven: 1 critical advisory ( org.opendaylight.sfc:sfc-parent ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- Go: 1 critical advisory ( k8s.io/ingress-nginx ). Check with govulncheck ./... .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Check exposure** [IngressNightmare: ingress-nginx Cluster Takeover RCE](https://erroneo.us/security/briefs/ingressnightmare-ingress-nginx-cve-2025-1974/index.md): Patched since March 2025. If any cluster still runs ingress-nginx below 1.11.5 or 1.12.1, that is a cluster-takeover risk, and the controller itself is now retired, so plan the migration while you check.

## Known exploited (CISA KEV)

- [CVE-2025-30154](https://erroneo.us/security/cve/CVE-2025-30154/index.md) reviewdog action-setup GitHub Action: reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability (CISA due 2025-04-14)

## Critical advisories

- [CVE-2025-29315](https://erroneo.us/security/cve/CVE-2025-29315/index.md) OpenDaylight SFC Allows Unauthorized Privileged Execution via Crafted Request — Maven org.opendaylight.sfc:sfc-parent <= 0.10.4 → no fix
- [CVE-2025-1974](https://erroneo.us/security/cve/CVE-2025-1974/index.md) ingress-nginx admission controller RCE escalation — Go k8s.io/ingress-nginx < 1.11.5 → 1.11.5; Go k8s.io/ingress-nginx >= 1.12.0-beta.0, < 1.12.1 → 1.12.1

---
Source page: https://erroneo.us/security/2025-03-24/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt