A week in security (July 11 – July 17)

Last week on Malwarebytes Labs: Elden Ring maker Bandai Namco hit by ransomware and data leaks Predatory Sparrow massively disrupts steel factories while keeping workers safe New variant of Android SpyJoker malware removed from Play Store after 3 million+ installs China’s Tonto Team increases...

Denial Of Service (DoS)

wolfssl is vulnerable to denial of service. The vulnerability exists due to an implementation error in DTLS, allowing an attacker to crash the application...

Builder XtremeRAT 3.7 MVID-2022-0624 Insecure Crypto Bypass

Discovery / credits: Malvuln John Page aka hyp3rlinx c 2022 Original source: https://malvuln.com/advisory/7f314e798c150aedd9ce41ed39318f65B.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Builder XtremeRAT v3.7 Vulnerability: Insecure Crypto Bypass Description: The malware...

Fedora: Security Advisory for golang-github-cespare-xxhash (FEDORA-2022-3969b64d4b)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for golang-gopkg-src-d-git-4 (FEDORA-2022-3969b64d4b)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for golang-github-jmespath (FEDORA-2022-3969b64d4b)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 35 Update: golang-k8s-pod-security-admission-1.22.0-3.fc35

Kubernetes Pod Security Standards implementation...

[SECURITY] Fedora 35 Update: golang-github-temoto-robotstxt-1.1.1-5.fc35

The robots.txt exclusion protocol implementation for Go language...

[SECURITY] Fedora 35 Update: golang-github-shurcool-vfsgen-0-0.11.20210113git0d455de.fc35

Package Vfsgen takes an http.FileSystem likely at go generate time and generates Go code that statically implements the provided http.FileSystem...

[SECURITY] Fedora 35 Update: golang-github-multiformats-multihash-0.1.0-2.fc35

Multihash implementation in Go...

[SECURITY] Fedora 35 Update: golang-github-multiformats-multibase-0.0.3-2.20220213gitf067816.fc35

Implementation of multibase parser in go...

[SECURITY] Fedora 35 Update: golang-github-jmespath-0.4.0-5.fc35

A JMESPath implementation in Go...

[SECURITY] Fedora 35 Update: golang-github-google-jsonnet-0.17.0-5.fc35

This an implementation of Jsonnet in pure Go. It is feature complete but is n ot as heavily exercised as the Jsonnet C++ implementation. Please try it out and give feedback...

[SECURITY] Fedora 35 Update: golang-github-dustinkirkland-petname-0-0.5.20200605git8e5a1ed.fc35

An RFC1178 implementation...

[SECURITY] Fedora 35 Update: golang-github-christrenkamp-goxpath-0-0.6.20200627gitc5096ec.fc35

An XPath 1.0 implementation written in the Go programming language...

[SECURITY] Fedora 35 Update: golang-github-cespare-xxhash-2.1.1-5.fc35

xxhash is a Go implementation of the 64-bit xxHash algorithm, XXH64. This is a high-quality hashing algorithm that is much faster than anything in the Go standard library...

[SECURITY] Fedora 35 Update: golang-github-bifurcation-mint-0-0.9.20200724git93c820e.fc35

A Minimal TLS 1.3 Implementation in Go...

[SECURITY] Fedora 35 Update: gojq-0.12.8-3.fc35

Pure Go implementation of jq...

[SECURITY] Fedora 35 Update: act-1.6.0-6.fc35

The Automatic Component Toolkit ACT is a code generator that takes an instance of an Interface Description Language file and generates a thin C89-API, implementation stubs and language bindings of your desired software component...

There is no method to unignore any ignored pair.

Lines of code Vulnerability details Impact The Witch contract uses setIgnoredPair function to prevent the liquidation of accepted pairs on the governance level. However, there is no method to remove these pairs from the ignoredPairs mapping. Proof of Concept Imagine there are vaults with UST/fyUS...