[SECURITY] Fedora 36 Update: golang-github-cloudflare-0.21.0-4.fc36

A Go library for interacting with Cloudflare's API v4. This library allows you to: - Manage and automate changes to your DNS records within Cloudflare - Manage and automate changes to your zones domains on Cloudflare, includi ng adding new zones to your account - List and modify the status of WAF...

Cloudflare WARP 安全漏洞

Cloudflare WARP Cloudflare Vpn is a client application for secure connections from the US company Cloudflare. A security vulnerability exists in Cloudflare WARP. An attacker can exploit this vulnerability to bypass configured zero-trust security policies e.g., Secure Web Gateway policy and featur...

Malicious code in yodaspeak-cloudflare-workers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 50f681261decb63857d04b9b6201be2b3bc996a9a9778fa0b9878db7f295a596 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7357 Malicious code in yodaspeak-cloudflare-workers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 50f681261decb63857d04b9b6201be2b3bc996a9a9778fa0b9878db7f295a596 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Fedora: Security Advisory for golang-github-cloudflare-redoctober (FEDORA-2022-3969b64d4b)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for golang-github-cloudflare (FEDORA-2022-3969b64d4b)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 35 Update: golang-github-cloudflare-0.17.0-3.fc35

A Go library for interacting with Cloudflare's API v4. This library allows you to: - Manage and automate changes to your DNS records within Cloudflare - Manage and automate changes to your zones domains on Cloudflare, includi ng adding new zones to your account - List and modify the status of WAF...

GO-2022-0252 Panic on misconfigured IP address in github.com/cloudflare/cfrpki

OctoRPKI crashes when a repository returns an ROA with a IP address that contains too many bits...

GO-2022-0251 Panic on NUL character in ROA in github.com/cloudflare/cfrpki

OctoRPKI crashes when a repository returns an invalid ROA that is only an encoded NUL character \0...

GO-2022-0248 Directory traversal in manifest path extraction in github.com/cloudflare/cfrpki

Manifest path extraction is vulnerable to directory traversal attacks. The ExtractPathManifest function permits file paths containing relative directory components "..", permitting files to reference arbitrary locations on the filesystem...

GO-2022-0246 Insufficient validation in github.com/cloudflare/cfrpki

The ROAEntry.Validate function fails to perform bounds checks on the MaxLength field, allowing invalid values to pass validation...

Tiny Mantis Botnet Can Launch More Powerful DDoS Attacks Than Mirai

By Waqas Mantis Botnet launched 3,000 DDoS attacks in one month using only 5,000 small bots after which Cloudflare dubbed… This is a post from HackRead.com Read the original post: Tiny Mantis Botnet Can Launch More Powerful DDoS Attacks Than Mirai...

GitLab: Found Origin IP's lead to access to gitlab

@m-narayanan disclosed a known Origin IP / CloudFlare bypass issue, remediation for which was and is being tracked at https://gitlab.com/gitlab-com/gl-infra/reliability/-/issues/9945 The requested disclosure, then later requested it to be made private again...

Mantis Botnet Behind the Largest HTTPS DDoS Attack Targeting Cloudflare Customers

The botnet behind the largest HTTPS distributed denial-of-service DDoS attack in June 2022 has been linked to a spate of attacks aimed at nearly 1,000 Cloudflare customers. Calling the powerful botnet Mantis, the web performance and security company attributed it to more than 3,000 HTTP DDoS...

Cloudflare Public Bug Bounty: Lack of Packet Sanitation in Goflow Results in Multiple DoS Attack Vectors and Bugs

sflow decode package of the Goflow application did not implement sufficient packet sanitisation which could lead to a denial of service attack. Attackers could craft malformed packets causing the process to consume large amounts of memory resulting in a denial of service. The issue has been fixed...

Cloudflare Public Bug Bounty: Ability to bypass locked Cloudflare WARP on wifi networks.

Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" feature resulting in Zero Trust policies not being enforced on an affected endpoint...

Cloudflare Public Bug Bounty: Completely remove VPN profile from locked WARP iOS cient.

It was possible for a user to delete VPN profile from WARP mobile client on iOS platform despite the Lock WARP switch feature being enabled on Zero Trust Platform. This led to bypassing policies and restriction enforced for enrolled devices by the Zero Trust platform. The issue was fixed in Warp...

Fedora: Security Advisory for golang-github-cloudflare (FEDORA-2022-fae3ecee19)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for golang-github-cloudflare-redoctober (FEDORA-2022-fae3ecee19)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Cloudflare Public Bug Bounty: Misconfigured build on websites "abuse.cloudflare.com"

Due to a misconfiguration, a malicious actor could see all the backend code on the abuse.cloudflare.com page. The engineering team removed the misconfiguration and the information is no longer available...