dnsmasq: Broken ECS source validation bypass

A validation bypass was discovered in dnsmasq's RFC 7871 client subnet ECS handling. When verifying ECS source information in DNS responses, dnsmasq passes the OPT record length instead of the full packet length to the validation function.This causes all internal bounds checks to fail, completely...

cloudsplaining

Cloudsplaining Cloudsplaining is an AWS IAM Security Assessment tool that identifies violations of least privilege and generates a risk-prioritized HTML report. Example report Documentation For full documentation, please visit the project on ReadTheDocs. Installation Cheatsheet Example report...

cpra

Continuous Pulse and Recovery Agent Checks services, sends alerts, and runs the recovery actions you configure. CPRa monitors services and runs the recovery actions you configure. One Go process schedules checks, tracks incidents, sends notifications and exposes a React dashboard, an HTTP API and...

content-packs

Content Packs for Eventum Ready-to-use generator projects for Eventum that produce realistic synthetic events mimicking real SIEM data sources. Each generator outputs ECS-compatible JSON that can be ingested directly into Elasticsearch, OpenSearch, or any SIEM platform. Quick Start With Docker...

Malicious code in @ifasn/mmdd-doc-mcp (npm)

Source: amazon-inspector 2999c5d0dd2a35fe1dfb6bdc17da36aaed07d4f6fa7e10f9f395a4b39d1c7265 @ifasn/mmdd-doc-mcp advertises itself as a Markdown TOC/stats/table MCP server, but on startup bin entry / npm start its index.js performs an unsolicited IMDSv2 handshake against the Alibaba Cloud ECS metada...

Malicious code in @ifasn/mmdd-doc-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2999c5d0dd2a35fe1dfb6bdc17da36aaed07d4f6fa7e10f9f395a4b39d1c7265 @ifasn/mmdd-doc-mcp advertises itself as a Markdown TOC/stats/table MCP server, but on startup bin entry / npm start its index.js performs an...

Malicious code in @ifasn/mdd-doc-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8295dd6d1f932aa9f2b865822f1a6f213e00fc288b35cd4b7d8fa0f07a8641 On load, index.js queries the Alibaba Cloud ECS instance metadata service at 100.100.100.200, performs the IMDSv2-style PUT to obtain a metadata toke...

ecs-mapping

Corelight ECS Ingest Pipeline The repository is compromised of Ingest Pipeline files required to be used with the installer script in the repository https://github.com/corelight/ecs-templates The installer in that repository will download the files from this repository therefore using this...

CVE20264893poc

Topology: https://medium.com/@yanyuyingshu/reproduction-journal-dnsmasq-ecs-validation-and-buffer-overflow-flaws-e0fe0f66f60c Steps​ 1.vi /etc/dnsmasq.conf​ port=5353​ listen-address=xxx.xxx.xxx.x bind-interfaces​ no-resolv​ no-hosts​ no-poll​ cache-size=1000​ log-queries​ log-facility=-​...

CLEANSTART-2025-OP11159 If a resolver cache has a very large number of ECS records stored for the same name, the process of cleaning the cache database node for this name can significantly impair query performance

Security vulnerability affects the bind package. If a resolver cache has a very large number of ECS records stored for the same name, the process of cleaning the cache database node for this name can significantly impair query performance...

siphondns

SiphonDNS A PoC for techniques described in this research. Implements data exfiltration via non-standard sections of DNS. Server: $ ./siphondns-server -method ecs Starting DNS server cmd id Command received Receiving data...

Amazon Linux 2023 : ecs-service-connect-agent (ALAS2023-2026-3355)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3355 advisory. Issue summary: A certificate with many nameRelativeToCRLIssuer CRLdistribution points causes disproportionate heap growth when OpenSSL cachesX.509 extensions. Impact summary: Receiving a crafted...

Amazon Linux 2023 : ecs-init (ALAS2023-2026-3359)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3359 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates issued by th...

Medium: ecs-init

Issue Overview: Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates issued by the affected intermediate certificates. This would prevent possible future misuse ...

Low: ecs-service-connect-agent

Issue Overview: Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possib...

Medium: amazon-ecr-credential-helper

Issue Overview: Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates issued by the affected intermediate certificates. This would prevent possible future misuse ...

Medium: ecs-init

Issue Overview: Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates issued by the affected intermediate certificates. This would prevent possible future misuse ...

Amazon Linux 2 : ecs-init (ALASECS-2026-156)

The version of ecs-init installed on the remote host is prior to 1.108.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2026-156 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the...

Medium: containerd

Issue Overview: Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates issued by the affected intermediate certificates. This would prevent possible future misuse ...

Low: ecs-service-connect-agent

Issue Overview: Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possib...