Re:MOVEit body count closes in on 400 orgs, 20M+ individuals
by jeroenhd on Sunday July 23, 2023 @02:00PM
(#36837899)
> The May 31 bug – a SQL injection vulnerability – was the first. Progress patched this one, tracked as CVE-2023-34362, the next day. A second bug, CVE-2023-35036, came to light on June 9, and was also patched the next day.
> Progress disclosed a third hole, CVE-2023-35708, on June 15.
> Finally (we hope), three additional vulnerabilities – CVE-2023-36934, CVE-2023-36932, and CVE-2023-36933 – were spotted and fixed on July 5.
It seems like fixes came out the same day or the day after the problems were discovered. Yet an estimated 23% of customers are still vulnerable to the recent CVEs.
It seems to me that there's more going on than just shitty security practices by Progress Software, as reported on by this article. The fixes are out, the problems are known, and the fixes are available.
> Progress disclosed a third hole, CVE-2023-35708, on June 15.
> Finally (we hope), three additional vulnerabilities – CVE-2023-36934, CVE-2023-36932, and CVE-2023-36933 – were spotted and fixed on July 5.
It seems like fixes came out the same day or the day after the problems were discovered. Yet an estimated 23% of customers are still vulnerable to the recent CVEs.
It seems to me that there's more going on than just shitty security practices by Progress Software, as reported on by this article. The fixes are out, the problems are known, and the fixes are available.