- Google Releases Security Updates for Chrome
- Drupal Releases Security Updates
- CISA and DoD Release 5G Security Evaluation Process Investigation Study
- Citrix Releases Security Updates for ADC and Gateway
- CISA Adds 34 Known Exploited Vulnerabilities to Catalog
- Mozilla Releases Security Updates for Multiple Firefox Products
_______________________________
Google Releases Security Updates for Chrome
Situation:
Chrome announced the promotion of Chrome 102 to the stable channel for Windows (102.0.5005.61/62/63), 102.0.5005.61 for Mac and Linux. Chrome 102 is also promoted to Google’s new extended stable channel for Windows and Mac.
Problem:
This version includes 32 security fixes.
Implication:
An attacker could exploit the vulnerabilities to take control of an affected system.
Need:
CISA encourages users and administrators to review the Chrome Release Note and apply the necessary update.
Additional Resources:
For a brief overview:
https://www.cisa.gov/uscert/ncas/current-activity/2022/05/25/google-releases-security-updates-chrome
For a more detailed overview:
https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_24.html
Chrome Release Cycle:
https://chromium.googlesource.com/chromium/src/+/refs/heads/main/docs/process/release_cycle.md
________________________________
Drupal Releases Security Updates
Situation:
Drupal has released security updates.
Problem:
There is a vulnerability that does not affect Drupal core, but may affect some contributed projects or custom code on Drupal sites.
Implication:
Exploitation of this vulnerability could allow a remote attacker to take control of an affected website.
Need:
Users and administrators should review the Drupal security advisory SA-CORE-010 and apply the necessary updates.
Additional Resources:
CISA Bulletin:
https://www.cisa.gov/uscert/ncas/current-activity/2022/05/26/drupal-releases-security-updates
Drupal Security Advisory SA-CORE-010:
https://www.drupal.org/sa-core-2022-010
________________________________
CISA and DoD Release 5G Security Evaluation Process Investigation Study
Situation:
CISA and the Department of Defense (DoD) have released their 5G Security Evaluation Process Investigation Study for federal agencies.
Problem:
The study provides an overview of the proposed 5G Security Evaluation Process and applies the process to a private 5G network use case to demonstrate considerations for each step within the overarching process.
Implication:
The proposed process detailed in the study can support government agency activities during the Risk Management Framework system-level “Prepare” step for 5G-enabled systems.
Need:
CISA encourages federal program and project managers involved in 5G implementation to review the blog post by CISA Executive Assistant Director Eric Goldstein, CISA, DHS S&T, DOD Introduce Results of an Assessment into the 5G Security Evaluation Process, which links to the study.
Additional Resources:
Risk Management Framework :
https://csrc.nist.gov/Projects/Risk-Management
CISA, DHS S&T, DOD Introduce Results of an Assessment into the 5G Security Evaluation Process:
For a brief overview:
________________________________
Citrix Releases Security Updates for ADC and Gateway
Situation:
Citrix has released security updates to address two vulnerabilities found in Citrix ADC and Citrix Gateway.
Problem:
The vulnerabilities patched are a Medium severity authenticated denial-of-service and a High severity unauthenticated denial-of-service.
Implication:
An attacker could exploit these vulnerabilities to cause a denial-of-service condition.
Need:
The CISA encourages users and administrators to review Citrix Security Update CTX457048 and apply the necessary updates. Additional information can be found in the link below.
Additional Resources:
Citrix Security Bulletin:
https://support.citrix.com/article/CTX457048
________________________________
CISA Adds 34 Known Exploited Vulnerabilities to Catalog
Situation
CISA has added 34 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.
Problem
These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.
Implication
An attacker could exploit one of these vulnerabilities to take control and or damage an affected device.
Need
CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the Catalog that meet the meet the specified criteria.
Additional Resources:
Important Links:
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
________________________________
Mozilla Releases Security Updates for Multiple Firefox Products
Situation
Mozilla has released security updates to address vulnerabilities in Firefox 100.0.2, Firefox for Android 100.3.0, and Firefox ESR 91.9.1.
Problem
If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code in a privileged context.
An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading to prototype pollution and ultimately attacker-controlled JavaScript executing in the privileged parent process.
Implication
An attacker could exploit these vulnerabilities to take control of an affected system.
Need
CISA encourages users and administrators to review Mozilla security advisory MFSA 2022-19 and apply the necessary updates.
Additional Resources:
https://www.mozilla.org/en-US/security/advisories/mfsa2022-19/