Critical Photon OS Security Update - PHSA-2022-0286

Updates of 'linux-rt', 'libtiff', 'linux', 'linux-aws', 'linux-secure' packages of Photon OS have been released...

Use After Free

linux-oracle, linux-azure, linux-aws, linux-gcp, linux-kvm, linux-dell300x is vulnerable to free of use. The vulnerability exists in drivers/scsi/stex.c because it allows local users to obtain sensitive information from kernel memory because stexqueuecommandlck lacks a memset...

Rapid7 and HashiCorp Partner to Secure Terraform-based Cloud Infrastructure Deployments

Welcome to the latest installment in our cloud security “shift-left” blog series. In our last post, we covered the importance of integrating cloud infrastructure security assessments into DevOps tools and enabling Infrastructure as Code IaC developers. This time, we’re focusing on Rapid7’s recent...

nuvola - Tool To Dump And Perform Automatic And Manual Security Analysis On Aws Environments Configurations And Services

nuvola with the lowercase n is a tool to dump and perform automatic and manual security analysis on AWS environments configurations and services using predefined, extensible and custom rules created using a simple Yaml syntax. The general idea behind this project is to create an abstracted digita...

USN-5729-1: Linux kernel vulnerabilities

It was discovered that a race condition existed in the instruction emulator of the Linux kernel on Arm 64-bit systems. A local attacker could use this to cause a denial of service system crash. CVE-2022-20422 Hsin-Wei Hung discovered that the BPF subsystem in the Linux kernel contained an...

USN-5728-1: Linux kernel vulnerabilities

Jann Horn discovered that the Linux kernel did not properly track memory allocations for anonymous VMA mappings in some situations, leading to potential data structure reuse. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2022-427...

Moderate Photon OS Security Update - PHSA-2022-4.0-0280

Updates of 'linux-aws', 'linux', 'linux-secure', 'linux-rt' packages of Photon OS have been released...

awscli bug fix and enhancement update

An update is available for awscli. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linux 8.7...

@backland/accounts (>=0.1.3-alpha.2022.11.25.20.14.44.0 <=0.1.3-alpha.20221123222206.0), @backland/entity (>=0.1.3-alpha.2022.11.25.20.14.44.0 <=0.1.3-alpha.20221123222206.0) +29 more potentially affected by CVE-2022-41713 via deep-object-diff (=1.1.7)

deep-object-diff NPM version =1.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on deep-object-diff and may be impacted: - @backland/accounts =0.1.3-alpha.2022.11.25.20.14.44.0, =0.1.3-alpha.2022.11.25.20.14.44.0, =0.1.3-alpha.2022.11.25.20.14.44.0,...

Important Photon OS Security Update - PHSA-2022-4.0-0275

Updates of 'linux-aws', 'linux-esx', 'linux-secure', 'linux-rt' packages of Photon OS have been released...

Threatest - Threatest Is A Go Framework For End-To-End Testing Threat Detection Rules

Threatest is a Go framework for testing threat detection end-to-end. Threatest allows you to detonate an attack technique, and verify that the alert you expect was generated in your favorite security platform. Read the announcement blog post:...

DEBIAN-CVE-2022-3697

A flaw was found in Ansible in the amazon.aws collection when using the towercallback parameter from the amazon.aws.ec2instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs...

CVE-2022-3697

A flaw was found in Ansible in the amazon.aws collection when using the towercallback parameter from the amazon.aws.ec2instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs...

CVE-2022-3697

A flaw was found in Ansible in the amazon.aws collection when using the towercallback parameter from the amazon.aws.ec2instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs...

CVE-2022-3697

A flaw was found in Ansible in the amazon.aws collection when using the towercallback parameter from the amazon.aws.ec2instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs...

CVE-2022-3697

A flaw was found in Ansible in the amazon.aws collection when using the towercallback parameter from the amazon.aws.ec2instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs...

CVE-2022-3697

A flaw was found in Ansible in the amazon.aws collection when using the towercallback parameter from the amazon.aws.ec2instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs...

Threat Actors Target AWS EC2 Workloads to Steal Credentials

We found malicious samples attempting to steal Amazon Elastic Compute Cloud EC2 Workloads' access keys and tokens via typosquatting and the abuse of legitimate tools...

Important Photon OS Security Update - PHSA-2022-3.0-0477

Updates of 'mysql', 'linux-secure', 'linux-rt', 'libtiff', 'linux', 'linux-esx', 'linux-aws' packages of Photon OS have been released...

Malicious Package

Overview ceedee is a malicious package. This is a "dependency confusion" package, which means the package name is based on existing repositories, namespaces, or components, it aims to trick users into downloading the package which contains a malicious code. This package exfiltrates user data such...