Blog Section
Elasticsearch has released elasticsearch-py 7.14.0, the official client library for Python, which includes a change that blocks connections to servers using a non-original commercial Elasticsearch platform. The client library will now output an error if the other side presents itself in the 'X-Elastic-Product' header as anything other than 'Elasticsearch' for new releases, or fails to convey the tagline and […]
Vulnerabilities have been identified in the standard libraries of Rust and Go, related to the improper handling of IP addresses containing octal digits in address parsing functions. These vulnerabilities allow bypassing acceptable address checks in applications, for instance, to access loopback interface addresses (127.x.x.x) or intranet subnets during SSRF (Server-side request forgery) attacks. These vulnerabilities continue the cycle of problems previously identified in the node-netmask libraries […]
The release of the Linux distribution Bottlerocket 1.2.0 is available, developed in collaboration with Amazon for efficient and secure deployment of isolated containers. The tools and management components of the distribution are written in Rust and distributed under MIT and Apache 2.0 licenses. Bottlerocket supports deployment in Amazon ECS, VMware, and AWS EKS Kubernetes clusters, as well as the creation of custom builds and editions that allow for the use of […]
The release of Nmap 7.92, a network security scanner designed for network auditing and identifying active network services, is now available. This new version addresses issues noted by the Fedora project regarding compatibility with NPSL open-source license criteria (based on GPLv2), under which the Nmap code is distributed. In this new license version, there is a mandatory requirement to purchase a separate commercial license when using the code in proprietary […]
Google is working on providing full builds of the Chrome browser for Fuchsia OS. Fuchsia already offers a browser engine based on the Chromium codebase for running isolated web applications, but the browser as a standalone full product for Fuchsia has not been available, and the platform has primarily been developed for IoT and consumer devices like the Nest Hub. The latest […]
After two years of development, the release of Latte Dock 0.10 has been presented, offering an elegant and simple solution for managing tasks and plasmoids. It also supports a parabolic zoom effect for icons similar to macOS or the Plank dock. The Latte dock is built on the KDE Frameworks and Qt libraries. Integration with the KDE Plasma desktop is supported. The project's code is distributed […]
Web systems where the front end receives connections via HTTP/2 and transmits to the backend over HTTP/1.1 have been vulnerable to a new variant of the "HTTP Request Smuggling" attack. This allows attackers to inject specially crafted client requests into the content of requests from other users being handled in the same stream between the front end and backend. The attack can be used to inject malicious JavaScript code into a session with a legitimate […]
Winners of the annual Pwnie Awards 2021 have been announced, highlighting the most significant vulnerabilities and absurd failures in computer security. The Pwnie Awards are considered the equivalent of the Oscars and Golden Raspberries in the field of computer security. Main winners (list of nominees): Best vulnerability leading to privilege escalation. The award goes to Qualys for identifying the CVE-2021-3156 vulnerability in the sudo utility, which allows obtaining root privileges. […]
The release of EdgeX 2.0 has been announced, an open modular platform designed for interoperability between IoT devices, applications, and services. The platform is hardware- and operating system-agnostic and is developed by an independent working group under the auspices of the Linux Foundation. The platform's components are written in Go and distributed under the Apache 2.0 license. EdgeX enables the creation of gateways that integrate existing IoT devices and […]
The release of PipeWire 0.3.33 has been published, which is developing a next-generation multimedia server intended to replace PulseAudio. PipeWire extends the capabilities of PulseAudio by providing tools for handling video streams, enabling audio processing with minimal latency, and introducing a new security model for access control at the level of individual devices and streams. The project is supported in GNOME and is already applied by default in Fedora Linux. […]
Kees Cook, former chief system administrator at kernel.org and leader of the Ubuntu Security Team, now working at Google on securing Android and ChromeOS, expressed concern about the current process of fixing bugs in stable kernel branches. Approximately one hundred fixes are included in stable branches each week, and after the closure of the change acceptance window, the next release approaches one thousand […]
Osterman Research has published results from a study on the usage of open components with unpatched vulnerabilities in custom proprietary software (COTS). The study examined five categories of applications — web browsers, email clients, file transfer programs, messaging apps, and platforms for online meetings. The results were alarming — the use of open code with […]