The Patching Friars' AlmanacA calendar of CVE saints

Patron of December 19

AchillesHoly card for achilles-2, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 Achilles CALX CUSTODIS
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint Achilles, of Gatekeeper's Heel

Patron of Gatekeeper, download quarantine, and anyone who downloads an app and opens it without a second thought.

Life

On 19 December 2022 Microsoft disclosed Achilles, a macOS flaw found by Jonathan Bar Or. By applying very restrictive access control lists to a downloaded file, the browser was prevented from tagging it with the quarantine attribute, the one that triggers Gatekeeper's check. Without that mark, an unsigned app could launch as if it were trusted. Apple fixed it in December.

Prayer

O Saint Achilles, who finds the guardian's unguarded spot, let quarantine apply to everything that comes from outside. Amen.

How to celebrate

Celebrated by updating macOS to the fixed versions and distrusting apps that arrive without quarantine.

Even the guardian has a heel.

Technical record

Disclosed on
December 19 2022
CVE
CVE-2022-42821
CVSS
5.5
Product
Apple · macOS

A logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.2, macOS Big Sur 11.7.2, macOS Ventura 13. An app may bypass Gatekeeper checks.

Sources: microsoft.com

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.