Our news and updates

In Spring Framework versions 5.3.0 to 5.3.38 a medium severity vulnerability CVE-2024-38808 was detected. This vulnerability allows for a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition. To fix this issue, users must upgrade the Spring Framework version to 5.3.39. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-38808.

In OpenStack versions 16.1, 16.2, 17.1 a high severity vulnerability CVE-2024-8007 was detected. This vulnerability allows an attacker to deploy potentially compromised container images via disabling TLS certificate verification for registry mirrors, which could enable a man-in-the-middle (MITM) attack. To fix this issue, users must upgrade OpenStack to the latest version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-8007/.

In MongoDB Server versions 5.0 prior to 5.0.14 and 6.0 prior to 6.0.3 a medium severity vulnerability CVE-2024-8207 was detected. This vulnerability allows attackers with access to the server to take control of the MongoDB process by loading malicious files when it starts. To fix this problem, users should upgrade MongoDB Server to versions 6.1.1, 5.0.14, and 6.0.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-8207.

In Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 a medium severity vulnerability CVE-2024-8071 was detected. This vulnerability allows attackers with certain permissions to elevate their privileges to become a system administrator, giving them full control over the Mattermost system. To fix this issue, users should upgrade Mattermost to versions 9.11.0, 9.9.2, 9.5.8, 9.10.1 and 9.8.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-8071.

In Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, and 9.8.x <= 9.8.2 a medium severity vulnerability CVE-2024-32939 was detected. When shared channels are enabled, remote users’ original email addresses stored in user properties are not redacted, even when email visibility is configured to be hidden on the local server. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-32939.

In Mattermost versions ≤ 1.0.0 a medium severity vulnerability CVE-2024-43105 was detected. This vulnerability allows a user to consume excessive resources by running the /export command multiple times at once. To fix this issue, users must upgrade Mattermost to version 1.0.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-43105.

In OpenSearch versions 2.16.0, 1.3.19 and earlier a medium severity vulnerability CVE-2024-43794 was detected. The Dashboards Security Plugin adds a user interface for managing security features. Improper validation of the nextUrl parameter may cause an external redirect during login if certain parameters are manipulated. To fix this problem, users should upgrade to version 1.3.19 or 2.16.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-43794.

In OpenShift versions from 2.6.7 through 2.8.13 a high severity vulnerability CVE-2024-6508 was detected. A flaw in the OpenShift Console’s OAuth2 protocol can allow Cross-Site Request Forgery (CSRF) attacks due to improper use of the state parameter, enabling unauthorized access to accounts. The attack requires initiation from within the local network and no exploit is available. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-6508.

In the CPython “zipfile” module versions from 3.0 through 3.13.0 a high severity vulnerability CVE-2024-8088 was detected. The “zipfile.ZipFile” class is not affected. However, using “zipfile.Path” methods like “namelist()” or “iterdir()” on a malicious zip file can cause an infinite loop, but only in programs that handle user-controlled zip archives. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-8088.