Digest · Wednesday

Security digest: May 14, 2025

1 known exploited (cisa kev) addition and 3 critical advisories.

Take stock

Do you run any of these? Fortinet Multiple Products. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-06-04.
Maven: 3 critical advisories (io.jenkins.plugins:oidc-provider, io.github.bonigarcia:webdrivermanager, org.apache.iotdb:iotdb-core). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
PyPI: 1 critical advisory (apache-iotdb). Check with pip-audit (or: pip show <package>).
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVE	Product and flaw	CISA due
CVE-2025-32756	Fortinet Multiple Products Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability	2025-06-04

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

Jenkins OpenID Connect Provider Plugin Incorrectly Validates Crafted Build ID Tokens CVE-2025-47884 CVSS 9.1 Critical
io.jenkins.plugins:oidc-provider < 111.v29fd614b3617 → fixed in 111.v29fd614b_3617
BoniGarcia WebDriverManager Affected By Improper Restriction of XML External Entity Reference CVE-2025-4641 CVSS 9.3 Critical
io.github.bonigarcia:webdrivermanager >= 1.0.0, < 6.1.0 → fixed in 6.1.0
Apache IoTDB Vulnerable to Remote Code Execution CVE-2024-24780 CVSS 9.8 Critical
org.apache.iotdb:iotdb-core >= 1.0.0, < 1.3.4 → fixed in 1.3.4; apache-iotdb >= 1.0.0, < 1.3.4 → fixed in 1.3.4

Check: pip-audit (or: pip show <package>)

Apache IoTDB Vulnerable to Remote Code Execution CVE-2024-24780 CVSS 9.8 Critical
org.apache.iotdb:iotdb-core >= 1.0.0, < 1.3.4 → fixed in 1.3.4; apache-iotdb >= 1.0.0, < 1.3.4 → fixed in 1.3.4