Digest · Tuesday

Security digest: April 1, 2025

1 known exploited (cisa kev) addition and 3 critical advisories.

Take stock

Do you run any of these? Apache Tomcat. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-04-22.
Maven: 2 critical advisories (org.apache.pinot:pinot-broker, org.apache.pinot:pinot-common, org.apache.pinot:pinot-controller, org.apache.parquet:parquet-avro). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
Go: 1 critical advisory (github.com/rancher/rancher). Check with govulncheck ./....
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVE	Product and flaw	CISA due
CVE-2025-24813	Apache Tomcat Apache Tomcat Path Equivalence Vulnerability	2025-04-22

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

Apache Pinot Vulnerable to Authentication Bypass CVE-2024-56325 CVSS 9.3 Critical
org.apache.pinot:pinot-broker >= 0.8.0, < 1.3.0 → fixed in 1.3.0; org.apache.pinot:pinot-common >= 0.8.0, < 1.3.0 → fixed in 1.3.0; org.apache.pinot:pinot-controller >= 0.8.0, < 1.3.0 → fixed in 1.3.0
Apache Parquet Avro Module Vulnerable to Arbitrary Code Execution CVE-2025-30065 CVSS 10.0 Critical
org.apache.parquet:parquet-avro < 1.15.1 → fixed in 1.15.1

Check: govulncheck ./...

Rancher: Restricted Administrator can change Administrator's passwords CVE-2025-23391 CVSS 9.1 Critical
github.com/rancher/rancher >= 2.8.0, < 2.8.14 → fixed in 2.8.14; github.com/rancher/rancher >= 2.9.0, < 2.9.8 → fixed in 2.9.8; github.com/rancher/rancher >= 2.10.0, < 2.10.4 → fixed in 2.10.4