Internet News Section
A new version of the CalyxOS project 2.8.0 is available, developing firmware based on Android 11, free from ties to Google services and providing additional means for privacy and security. The ready firmware variant is prepared for Pixel devices (2, 2 XL, 3, 3a, 3 XL, 4, 4a, 4 XL, and 5) and Xiaomi Mi A2. Platform features include monthly […]
The release of the GNUnet 0.15 framework, designed for building secure decentralized P2P networks, has been presented. Networks created with GNUnet do not have a single point of failure and can guarantee the privacy of user information, including preventing potential abuses by security agencies and administrators who have access to network nodes. GNUnet supports the creation of P2P networks over TCP, UDP, HTTP/HTTPS, Bluetooth, and WLAN, […]
A massive attack on home routers has been recorded, where the firmware uses an implementation of the HTTP server from Arcadyan. A combination of two vulnerabilities is employed to gain control over the devices, allowing arbitrary code execution with root privileges. The issue affects a wide range of ADSL routers from companies like Arcadyan, ASUS, and Buffalo, as well as devices supplied under the Beeline brand (the issue has been confirmed […]
Elasticsearch has released elasticsearch-py 7.14.0, the official client library for Python, which includes a change that blocks connections to servers using a non-original commercial Elasticsearch platform. The client library will now output an error if the other side presents itself in the 'X-Elastic-Product' header as anything other than 'Elasticsearch' for new releases, or fails to convey the tagline and […]
Vulnerabilities have been identified in the standard libraries of Rust and Go, related to the improper handling of IP addresses containing octal digits in address parsing functions. These vulnerabilities allow bypassing acceptable address checks in applications, for instance, to access loopback interface addresses (127.x.x.x) or intranet subnets during SSRF (Server-side request forgery) attacks. These vulnerabilities continue the cycle of problems previously identified in the node-netmask libraries […]
The release of the Linux distribution Bottlerocket 1.2.0 is available, developed in collaboration with Amazon for efficient and secure deployment of isolated containers. The tools and management components of the distribution are written in Rust and distributed under MIT and Apache 2.0 licenses. Bottlerocket supports deployment in Amazon ECS, VMware, and AWS EKS Kubernetes clusters, as well as the creation of custom builds and editions that allow for the use of […]
The release of Nmap 7.92, a network security scanner designed for network auditing and identifying active network services, is now available. This new version addresses issues noted by the Fedora project regarding compatibility with NPSL open-source license criteria (based on GPLv2), under which the Nmap code is distributed. In this new license version, there is a mandatory requirement to purchase a separate commercial license when using the code in proprietary […]
Google is working on providing full builds of the Chrome browser for Fuchsia OS. Fuchsia already offers a browser engine based on the Chromium codebase for running isolated web applications, but the browser as a standalone full product for Fuchsia has not been available, and the platform has primarily been developed for IoT and consumer devices like the Nest Hub. The latest […]
After two years of development, the release of Latte Dock 0.10 has been presented, offering an elegant and simple solution for managing tasks and plasmoids. It also supports a parabolic zoom effect for icons similar to macOS or the Plank dock. The Latte dock is built on the KDE Frameworks and Qt libraries. Integration with the KDE Plasma desktop is supported. The project's code is distributed […]
Web systems where the front end receives connections via HTTP/2 and transmits to the backend over HTTP/1.1 have been vulnerable to a new variant of the "HTTP Request Smuggling" attack. This allows attackers to inject specially crafted client requests into the content of requests from other users being handled in the same stream between the front end and backend. The attack can be used to inject malicious JavaScript code into a session with a legitimate […]
Winners of the annual Pwnie Awards 2021 have been announced, highlighting the most significant vulnerabilities and absurd failures in computer security. The Pwnie Awards are considered the equivalent of the Oscars and Golden Raspberries in the field of computer security. Main winners (list of nominees): Best vulnerability leading to privilege escalation. The award goes to Qualys for identifying the CVE-2021-3156 vulnerability in the sudo utility, which allows obtaining root privileges. […]
The release of EdgeX 2.0 has been announced, an open modular platform designed for interoperability between IoT devices, applications, and services. The platform is hardware- and operating system-agnostic and is developed by an independent working group under the auspices of the Linux Foundation. The platform's components are written in Go and distributed under the Apache 2.0 license. EdgeX enables the creation of gateways that integrate existing IoT devices and […]