A critical OpenSSL vuln is coming this Tuesday, a SQLite vuln, Apple blogs about memory safety and bug bounties, determining a random shuffle
Don't forget to check out our library of on-demand webcasts & technical trainings at securityweekly.com/ondemand.
Mike Shema
- Forthcoming OpenSSL Releases
The last critical advisory seems to have been from 2016 and Heartbleed is about eight years old. So, even though this Tuesday promises to be a headache for orgs running OpenSSL version 3.0+, it's nice to see that the work going into maturing the code base seems to be paying off.
OpenSSL 3.0 has been out for just over a year, having been released in September 2021.
What's more interesting will be to watch the upgrade path and rate of adoption since version 1.1.1 has less than a year of support left.
- Stranger Strings: An exploitable flaw in SQLite | Trail of Bits Blog
SQLite has one of the most comprehensive and high coverage approaches to testing. So when we highlight a vuln in this relatively ubiquitous software, it's helpful to point out how rare the vulns tend to be and how much diligence the project puts into not only coverage of code, but the various types of testing it conducts. This vuln doesn't seem likely to lead to mass exploitation given the prerequisites for triggering it.
- Juniper SSLVPN / JunOS RCE and Multiple Vulnerabilities
This one has path traversal (yay!) and a handful of other vulns that hit a bunch of the OWASP Top 10 items, which makes the list of CVEs stand out as impressive for modern software.
- Towards the next generation of XNU memory safety: kalloc_type – Apple Security Research
A deep dive into hardening Apple's kernel against memory safety issues. Even if you're not interested in C or macOS internals, the article provides a great overview of a taxonomy of memory safety issues and how Apple has been thinking about countering this attack class.
- Blog – Apple Security Bounty. Upgraded.
Apple joins the ranks of companies highlighting how much they've spent on identifying vulns through the efforts of communities of researchers. As with all of these types of articles, I'm always curious what the money spent to fix the vulns looks like.
- How a magician-mathematician revealed a casino loophole – BBC Future
Another article that steps a little outside the usual software we focus on, but it touches on security testing for random number generators, adversarial users that make for fun threat models, and the impacts -- measurable in dollars in this case -- of insecure software.
John Kinsella
- Docker adds support for WASM
This could be interesting - Docker announced support for running WASM apps - without having to build a container, but instead use the WasmEdge runtime. Will this be the beginning of the end for containers? (hasn't happened to VMs yet...)
- Multiple vulnerabilities found in Jupiter ssl VPN
- Bringing the concepts of CALM for devops to the cloud
