33 matches found
CISA Releases Two SBOM Documents
Today, CISA released two community-drafted documents around Software Bill of Materials SBOM: Types of SBOM documents and Minimum Requirements for Vulnerability Exploitability eXchange VEX. The Types of SBOM document summarizes common types of SBOMs that tools may create in the industry today, alo...
CISA and CESER Releases Software Bill of Materials (SBOM) Sharing Lifecycle Report
CISA and the U.S. Department of Energy DOE Cybersecurity, Energy Security, and Emergency Response CESER have released the SBOM Sharing Lifecycle Report to the cybersecurity and supply chain community. The purpose of this report is to enumerate and describe the different parties and phases of the...
CVE-2023-24827 Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set in syft
syft is a a CLI tool and Go library for generating a Software Bill of Materials SBOM from container images and filesystems. A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFTATTESTPASSWORD environment variable. The...
CVE-2023-24827 Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set in syft
syft is a a CLI tool and Go library for generating a Software Bill of Materials SBOM from container images and filesystems. A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFTATTESTPASSWORD environment variable. The...
CVE-2023-24827
Syft (CLI + Go library for SBOMs) had a password disclosure vulnerability in v0.69.0–v0.69.1 where SYFT_ATTEST_PASSWORD could leak credentials in logs (DEBUG+ levels) and in attestations/SBOM payloads when using syft-json. The issue affects users who set SYFT_ATTEST_PASSWORD; users without it are...
Bomber - Scans Software Bill Of Materials (SBOMs) For Security Vulnerabilities
bomber is an application that scans SBOMs for security vulnerabilities. Overview So you've asked a vendor for an Software Bill of Materials SBOM for one of their closed source products, and they provided one to you in a JSON file... now what? The first thing you're going to want to do is see if a...
Kubeclarity - Tool For Detection And Management Of Software Bill Of Materials (SBOM) And Vulnerabilities Of Container Images And Filesystems
KubeClarity is a tool for detection and management of Software Bill Of Materials SBOM and vulnerabilities of container images and filesystems. It scans both runtime K8s clusters and CI/CD pipelines for enhanced software supply chain security. SBOM & vulnerability detection challenges Effective...
CVE-2022-1766
Anchore Enterprise anchorectl version 0.1.4 improperly stored credentials when generating a Software Bill of Materials. anchorectl will add the credentials used to access Anchore Enterprise API in the Software Bill of Materials SBOM generated by anchorectl. Users of anchorectl version 0.1.4 shoul...
[Security Nation] Kate Stewart on Open-Source Projects at the Linux Foundation
!\Security Nation\ Kate Stewart on Open-Source Projects at the Linux Foundationhttps://blog.rapid7.com/content/images/2022/04/securitynationlogo.jpg In this episode of Security Nation, Jen and Tod chat with Kate Stewart, VP of Dependable Embedded Systems at the Linux Foundation, about the...
Developer Sabotages Open-Source Software Package
This is a big deal: A developer has been caught adding malicious code to a popular open-source package that wiped files on computers located in Russia and Belarus as part of a protest that has enraged many users and raised concerns about the safety of free and open source software. The applicatio...
E.O. Would Strengthen Federal Cyber Requirements
The U.S. federal government is mulling changes to up its cybersecurity software game in the wake of the sprawling SolarWinds cyberattacks that came to light in December, including requiring data-breach notifications. In a draft executive order from President Joe Biden, software companies would be...
IPTV encoder devices contain multiple vulnerabilities
Overview Multiple vulnerabilities exist in various Video Over IP Internet Protocol encoder devices, also known as IPTV/H.264/H.265 video encoders. These vulnerabilities allow an unauthenticated remote attacker to execute arbitrary code and perform other unauthorized actions on a vulnerable system...
