Digest · Friday
Security digest: April 18, 2025
3 critical advisories.
All digests · RSS · Markdown
Take stock
- NuGet: 1 critical advisory (
Apache.NMS.ActiveMQ). Check withdotnet list package --vulnerable --include-transitive. - Go: 1 critical advisory (
github.com/traefik/traefik/v2,github.com/traefik/traefik/v3). Check withgovulncheck ./.... - PyPI: 1 critical advisory (
torch). Check withpip-audit (or: pip show <package>). - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 0
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
None.
Critical advisories by ecosystem 3
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Go 1
Check: govulncheck ./...
- Traefik affected by Go HTTP Request Smuggling Vulnerability GHSA-5423-jcjm-2gpv CVSS 9.1 Critical
github.com/traefik/traefik/v2< 2.11.24 → fixed in 2.11.24;github.com/traefik/traefik/v3< 3.3.6 → fixed in 3.3.6;github.com/traefik/traefik/v3= 3.4.0-rc1 → fixed in 3.4.0-rc2
NuGet 1
Check: dotnet list package --vulnerable --include-transitive
- Apache ActiveMQ NMS OpenWire Client Deserialization of Untrusted Data vulnerability CVE-2025-29953 CVSS 9.8 Critical
Apache.NMS.ActiveMQ< 2.1.1 → fixed in 2.1.1
PyPI 1
Check: pip-audit (or: pip show <package>)
- PyTorch: `torch.load` with `weights_only=True` leads to remote code execution CVE-2025-32434 CVSS 9.3 Critical
torch< 2.6.0 → fixed in 2.6.0