chaosmonkey

Chaos Monkey は、本番環境内で実行されている仮想マシンインスタンスとコンテナをランダムに終了させます。エンジニアに障害をより頻繁に経験させることで、回復力のあるサービスを構築するよう促します。 Chaos Monkey の使用方法については、ドキュメント を参照してください。 Chaos Monkey は、カオスエンジニアリングの原則 に従うツールの一例です。 要件 このバージョンの Chaos Monkey は、Netflix で使用している継続的デリバリープラットフォームである Spinnaker と完全に統合されています。Chaos Monkey...

spring-cloud-netflix-hystrix-dashboard-cve-2021-22053

CVE-2021-22053: Spring Cloud Netflix Hystrix Dashboard 템플릿 해석 취약점 심각도 높음 공급업체 VMware의 Spring 설명 spring-cloud-netflix-hystrix-dashboard와 spring-boot-starter-thymeleaf를 함께 사용하는 애플리케이션은 뷰 템플릿을 해석하는 동안 요청 URI 경로에 제출된 코드를 실행할 수 있는 방법을 노출합니다. /hystrix/monitor;사용자 제공 데이터로 요청이 이루어지면 hystrix/monitor 뒤의 경로...

Spring Cloud Netflix Hystrix Dashboard <2.2.10 - Remote Code Execution

Spring Cloud Netflix Hystrix Dashboard prior to version 2.2.10 is susceptible to remote code execution. Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the resolution of view...

security-bulletins

보안 공지 다음은 Netflix 오픈소스 애플리케이션 내 보안 및 개인정보 보호 이벤트에 대한 공지입니다. 날짜| 유형| 제목 ---|---|--- Septeember 27, 2024| 높음| E2Nest의 경로 탐색 August 1, 2024| 치명적| Dispatch 메시지 템플릿의 서버 측 템플릿 주입 May 16, 2024| 치명적| 제한된 Git 명령 RCE를 통한 ConsoleMe의 임의 파일 읽기 취약점 May 09, 2024| 치명적| Genie의 파일 업로드를 통한 경로 탐색 취약점 November 09,...

CVE-2024-4701-POC

CVE-2024-4701-POC CVE-2024-4701용 POC https://netflix.github.io/genie/docs/4.3.0/demo/docker-compose.yml 또는 이 저장소에서 genie docker 파일을 다운로드하세요. 실행하세요 docker-compose up 첨부된 http payload loadlib를 다운로드하세요. 다음 명령을 실행하세요. nc -w 5 localhost 8080 loadlib netcatnc을 설치해야 할 수도 있습니다. 이 명령은 docker에서 실행 중인 genie...

CVE-2026-71307

creationtimestamp| type| source ---|---|--- 2026-08-18 22:35:11+00:00| published-proof-of-concept| https://github.com/Netflix/lemur/security/advisories/GHSA-6c8m-q6g9-vrw3 2026-08-19 06:44:38+00:00| seen| https://gist.github.com/alon710/d3bb7a8e835fd653e6c886cd85f28aa2...

PYSEC-2026-919 Netflix Security Monkey Open Redirect vulnerability

Netflix Security Monkey before 0.8.0 has an Open Redirect. The logout functionality accepted the "next" parameter which then redirects to any domain irrespective of the Host header...

GHSA-J8PH-6FXJ-G533 Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch

Summary DataCenterInfo.FromJson throws ArgumentException for any name value other than "MyOwn" or "Amazon", despite the Java Eureka specification defining a third valid value: "Netflix". The exception propagates through the entire registry deserialization chain and is swallowed by the periodic...

EUVD-2026-37806

Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch...

Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch

Summary DataCenterInfo.FromJson throws ArgumentException for any name value other than "MyOwn" or "Amazon", despite the Java Eureka specification defining a third valid value: "Netflix". The exception propagates through the entire registry deserialization chain and is swallowed by the periodic...

PT-2026-55399

Summary DataCenterInfo.FromJson throws ArgumentException for any name value other than "MyOwn" or "Amazon", despite the Java Eureka specification defining a third valid value: "Netflix". The exception propagates through the entire registry deserialization chain and is swallowed by the periodic...

CVE-2026-55165

creationtimestamp| type| source ---|---|--- 2026-06-26 00:35:05+00:00| published-proof-of-concept| https://github.com/Netflix/lemur/security/advisories/GHSA-r9gp-7f88-9r54...

CVE-2026-55166

creationtimestamp| type| source ---|---|--- 2026-06-26 00:35:02+00:00| published-proof-of-concept| https://github.com/Netflix/lemur/security/advisories/GHSA-v2wp-frmc-5q3v 2026-08-18 20:01:28+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtez2cbezq2m 2026-08-18...

CVE-2026-55162

creationtimestamp| type| source ---|---|--- 2026-06-25 22:35:02+00:00| published-proof-of-concept| https://github.com/Netflix/lemur/security/advisories/GHSA-54vg-pfh7-jq95...

CVE-2026-50196

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Discovery.Eureka prior to versions 4.2.0 and 3.4.0, DataCenterInfo.FromJson throws ArgumentException for any name value other than "MyOwn" or "Amazon", despite...

CVE-2026-50196

CVE-2026-50196 – Steeltoe.Discovery.Eureka : In Steeltoe.Discovery.Eureka before versions 4.2.0 and 3.4.0, DataCenterInfo.FromJson throws an ArgumentException for any DataCenterInfo.name other than MyOwn, Amazon, or Netflix, causing the registry deserialization to fail and the cache refresh to sw...

CVE-2026-50196 Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Discovery.Eureka prior to versions 4.2.0 and 3.4.0, DataCenterInfo.FromJson throws ArgumentException for any name value other than "MyOwn" or "Amazon", despite...

CVE-2026-50196 Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Discovery.Eureka prior to versions 4.2.0 and 3.4.0, DataCenterInfo.FromJson throws ArgumentException for any name value other than "MyOwn" or "Amazon", despite...

PT-2026-50555

Name of the Vulnerable Software and Affected Versions Steeltoe.Discovery.Eureka versions prior to 3.4.0 Steeltoe.Discovery.Eureka versions prior to 4.2.0 Description The DataCenterInfo.FromJson function throws an ArgumentException when it encounters any name value other than "MyOwn" or "Amazon"...

INTERPOL Operation Takes Down Sniper Dz Phishing Platform, Arrests Administrator

An INTERPOL-led operation last month resulted in the disruption of Sniper Dz , a decade-long phishing-as-a-service PhaaS platform, Group-IB said Thursday. The effort, codenamed Operation Ramz, took place between October 2025 and February 2026, and saw authorities from 13 countries in the Middle...