erroneo.us
Search all guides⌘K

Digest · Friday

Security digest: June 20, 2025

2 critical advisories.

All digests · RSS · Markdown

Take stock

  • Go: 1 critical advisory (github.com/mattermost/mattermost-server, github.com/mattermost/mattermost/server/v8). Check with govulncheck ./....
  • PyPI: 1 critical advisory (rfc3161-client). Check with pip-audit (or: pip show <package>).
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 2

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Go 1

Check: govulncheck ./...

  • Mattermost allows authenticated users to write files to arbitrary locations CVE-2025-4981 CVSS 9.9 Critical
    github.com/mattermost/mattermost-server < 0.0.0-20250519205859-65aec10162f6 → fixed in 0.0.0-20250519205859-65aec10162f6; github.com/mattermost/mattermost/server/v8 < 8.0.0-20250519205859-65aec10162f6 → fixed in 8.0.0-20250519205859-65aec10162f6; github.com/mattermost/mattermost/server/v8 >= 10.5.0, <= 10.5.5 → fixed in 10.5.6; +4 more packages

PyPI 1

Check: pip-audit (or: pip show <package>)