CISA adds GeoSolutionsGroup JAI-EXT, Linux Kernel, and Roundcube Webmail bugs to its Known Exploited Vulnerabilities catalog

Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5 is vulnerable to cross-site scripting via malicious XML attachments, because text/xml is among the MIME types the client renders in the attachment preview, allowing embedded markup or script to execute in the victim's browser. An attacker triggers the flaw by emailing a crafted XML attachment and persuading a user to preview it. Successful exploitation lets the attacker run arbitrary JavaScript in the victim's webmail session, potentially hijacking the session, reading or manipulating mail, or acting as the user. Any Roundcube deployment running an affected version is exposed, including the Roundcube packages shipped in Debian and Fedora, though the share of installs still unpatched in 2024 is not documented in the available data. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2024-06-26, confirming exploitation in the wild, and a public proof-of-concept is available with EPSS at roughly 77% probability of exploitation within 30 days.

Do: Upgrade Roundcube to 1.3.12 or later on the 1.3 branch, or 1.4.5 or later on the 1.4 branch. If immediate patching is not possible, apply vendor mitigations — such as removing text/xml from the MIME types permitted for attachment preview — or discontinue use of the product per CISA's required action. Audit mail servers and hosting panels for Roundcube versions and monitor for suspicious activity around XML attachment previews.

CVE-2022-24816 is a critical (CVSS 3.1: 10.0) code injection flaw (CWE-94) in JAI-EXT, the open-source library that extends the Java Advanced Imaging (JAI) API. When an application allows Jiffle scripts to be submitted over a network request — most notably the downstream OSGeo GeoServer GIS server — the script is compiled into Java code using Janino and then executed, letting an attacker inject malicious code into the compiled script. Because the attack requires no privileges or user interaction and crosses security scopes, an unauthenticated attacker gains remote code execution on the server with the application's privileges. Any deployment of JAI-EXT prior to version 1.2.22 that accepts Jiffle scripts from network requests is affected, with GeoServer instances being the primary exposure. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-06-26 and carries a 98.5% EPSS score (100th percentile), indicating active exploitation in the wild, though no public proof-of-concept is known.

Do: Upgrade JAI-EXT to version 1.2.22 or later, which disables the ability to inject code into the compiled Jiffle script — for GeoServer operators this means moving to a GeoServer release that ships the patched JAI-EXT. If upgrading is not immediately possible, remove janino-x.y.z.jar from the application classpath so Jiffle scripts cannot be compiled at all. Per the CISA KEV listing (added 2024-06-26), apply these mitigations per vendor instructions or discontinue use, and check internet-facing GeoServer/WPS endpoints for signs of Jiffle-based code injection.

CVE-2022-2586 is a use-after-free (CWE-416) in the Linux kernel's netfilter/nftables subsystem, where an nft object or expression can reference an nft set belonging to a different nft table. When that other table is deleted, the reference becomes stale and the kernel accesses freed memory, which a local low-privileged user can leverage for privilege escalation and full compromise of the host (CVSS 3.1: 7.8, AV:L/PR:L with high confidentiality, integrity and availability impact). Any Linux deployment whose kernel carries the vulnerable nftables code is affected, including distributions such as Ubuntu Linux (Canonical is the assigned CNA). Exploitation is local, so internet-facing exposure matters mainly as a means for an attacker to first gain a local foothold. The bug is under active exploitation — CISA added it to the Known Exploited Vulnerabilities catalog on 2024-06-26 — and a public write-up with proof-of-concept material exists, with EPSS estimating a 10.5% chance of exploitation within 30 days.

Do: Apply kernel updates per vendor instructions — on Ubuntu, install the latest linux/linux-* packages for your release and reboot to load the patched kernel (per the CISA KEV required action, treating this as a priority item given confirmed in-the-wild exploitation). As interim mitigation, limit unprivileged users' ability to create nftables objects (e.g., restrict unprivileged user namespaces) and review local accounts on multi-user hosts; identify affected systems by checking kernel versions against your distribution's security advisories.