Getting 2FA Right in 2019
Since March, Trail of Bits has been working with the Python Software Foundation to add two-factor authentication (2FA) to Warehouse, the codebase that powers PyPI. As of today, PyPI members can enable time-based OTP (TOTP) and WebAuthn (currently in beta). If you have an account on PyPI, go enable your preferred 2FA method before you continue reading! 2018 and 2019 have been big years for two fact
Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled | Hacker News
Received this email a few minutes ago:"On Thursday, April 25th, 2019, we discovered unauthorized access to a single Hub database storing a subset of non-financial user data. Upon discovery, we acted quickly to intervene and secure the site. We want to update you on what we've learned from our ongoing investigation, including which Hub accounts are impacted, and what actions users should take. Here
TLS1.3時代ã®æ–°å¸¸è˜
TLS • TLS (reliable) endpoint endpoint CC BY 3.0 https://www.youtube.com/user/TheWikiLeaksChannel ClientHello+ ApplicationData end_of_early_data Finished ServerHello EncryptedExtension ServerConfiguration Certificate CertificateVerify Finished ApplicationData
Container Security Issue (CVE-2019-5736)
February 13, 2019 9:00 PM PST CVE Identifier: CVE-2019-5736 AWS is aware of the recently disclosed security issue which affects several open-source container management systems (CVE-2019-5736). With the exception of the AWS services listed below, no customer action is required to address this issue. Amazon Linux An updated version of Docker (docker-18.06.1ce-7.amzn2) is available for Amazon Linux
oss-sec: CVE-2019-5736: runc container breakout (all versions)
CVE-2019-5736: runc container breakout (all versions) From: Aleksa Sarai <cyphar () cyphar com> Date: Tue, 12 Feb 2019 00:05:20 +1100 [[ Patch CRD: 2019-02-11 15:00 CET ]] [[ Exploit Code CRD: 2019-02-18 15:00 CET ]] Hello, I am one of the maintainers of runc (the underlying container runtime underneath Docker, cri-o, containerd, Kubernetes, and so on). We recently had a vulnerability reported whi
PHPã®è„†å¼±æ€§ CVE-2018-17082 ã«ã‚ˆã‚‹ã‚ャッシュ汚染ã«ã¤ã„ã¦ã®æ³¨æ„å–šèµ·
エグゼクティブサマリ PHPã®è„†å¼±æ€§CVE-2018-17082ã¯XSSã¨ã—ã¦å ±å‘Šã•ã‚Œã¦ã„ã‚‹ãŒã€ç¾å®Ÿã«ã¯XSSã¨ã—ã¦ã®æ”»æ’ƒçµŒè·¯ã¯ãªã„。一方ã€Apacheã®mod_cacheã«ã‚ˆã‚‹ã‚ャッシュ機能を有効ã«ã—ã¦ã„るサイトã§ã¯ã€ã‚ャッシュ汚染ã¨ã„ã†æ”»æ’ƒã‚’å—ã‘ã‚‹å¯èƒ½æ€§ãŒã‚る。 æ¦‚è¦ PHPã®ç¾åœ¨ã‚µãƒãƒ¼ãƒˆä¸ã®ã™ã¹ã¦ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã«ã¤ã„ã¦ã€XSS脆弱性CVE-2018-17082ãŒä¿®æ£ã•ã‚Œã¾ã—ãŸã€‚以下ã¯å¯¾å¿œãƒãƒ¼ã‚¸ãƒ§ãƒ³ã§ã‚ã‚Šã€ã“れよりå‰ã®ã™ã¹ã¦ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ãŒå½±éŸ¿ã‚’å—ã‘ã¾ã™ã€‚ãŸã ã—ã€Apacheã¨ã®æŽ¥ç¶šã«Apache2handlerを用ã„ã¦ã„ã‚‹å ´åˆã«é™ã‚Šã¾ã™ã€‚ PHP 5.6.38 PHP 7.0.32 PHP 7.1.22 PHP 7.2.10 PHP 5.5以å‰ã‚‚対象ã§ã‚ã‚Šã€ã“れらã¯è„†å¼±æ€§ã¯ä¿®æ£ã•ã‚Œã¦ã„ã¾ã›ã‚“。 脆弱性をå†ç¾ã•ã›ã¦ã¿ã‚‹ ã“ã®è„†å¼±æ€§ã®PoCã¯ã€å½“å•é¡Œã®ãƒã‚°ãƒ¬ãƒãƒ¼ãƒˆã«ã‚ã‚Šã¾ã™ã€‚ PHP ::
ã©ã†ã—㦠JWT をセッションã«ä½¿ã£ã¡ã‚ƒã†ã‚ã‘？ - co3k.org
備考 2018/09/21 22:15 追記 2018/09/20 12:10 ã«å…¬é–‹ã—ãŸã€Œã©ã†ã—㦠JWT をセッションã«ä½¿ã£ã¡ã‚ƒã†ã‚ã‘？ã€ã¨ã„ã†ã‚¿ã‚¤ãƒˆãƒ«ãŒä¸é©åˆ‡ã ã¨ã”指摘をã„ãŸã ã„ã¦ã„ã¾ã™ã€‚ ãã®æ„見ã¯ã‚‚ã£ã¨ã‚‚ã ã¨æ€ã„ã¾ã™ã®ã§ã€ç¾åœ¨ã€é©åˆ‡ã¨ãªã‚‹ã‚ˆã†ã«ã‚¿ã‚¤ãƒˆãƒ«ã‚’調整ã—ã¦ã„ã¾ã™ã€‚ ã”迷惑ãŠã‚ˆã³ãŠé¨’ãŒã›ã‚’ã—ã¦å¤§å¤‰ç”³ã—訳ã”ã–ã„ã¾ã›ã‚“。 本文ã®è¡¨ç¾ã«ã¤ã„ã¦ã‚‚改善ã®ä½™åœ°ã¯å¤§ã„ã«ã‚ã‚Šãã†ã§ã™ãŒã€ã“ã¡ã‚‰ã¯ (ã™ã§ã«ã”æ„è¦‹ã‚’é ‚æˆ´ã—ã¦ã„る関係ã§ã€) 主張ãŒå¤‰ã‚ã£ã¦ã—ã¾ã‚ãªã„よã†ã«é…æ…®ã—ã¤ã¤æ…Žé‡ã«èª¿æ•´ã•ã›ã¦ã„ãŸã ãã‹ã‚‚ã—ã‚Œã¾ã›ã‚“。 ã¯ã‚ã‚ã‚ã€œã€œã€œã€œé ¼ã‚€ã‹ã‚‰ã“ã¡ã‚‰ã‚‚å¿™ã—ã„ã®ã§ã“ã‚“ãªã‚¨ãƒ³ãƒˆãƒªã‚’書ã‹ã›ãªã„ã§ã»ã—ã„ (挨拶)。もã—ãã¯åƒ•ã‚’暇ã«ã—ã¦ã“ã†ã„ã†ã‚¨ãƒ³ãƒˆãƒªã‚’書ã‹ã›ã‚‹ãŸã‚ã®ãƒ—ãƒã‚°ãƒ©ãƒžãƒ¼ã‚’募集ã—ã¦ã„ã¾ã™ (挨拶)。 JWT (JSON Web Token; RFC 7519) を充分ãªãƒªã‚¹ã‚¯ã®è¦‹ç©ã‚‚ã‚Šã‚’ã›ãšã‚»ãƒƒã‚·
ã€ç¿»è¨³ã€‘Laravelã‚’5.6ã‹ã‚‰5.6.30ã«ã‚¢ãƒƒãƒ—グレードã™ã‚‹(Security Release) - Endo Tech Blog
Laravelã®ã‚»ã‚ュリティリリースãŒã‚¢ãƒŠã‚¦ãƒ³ã‚¹ã•ã‚Œã¾ã—ãŸã€‚ laravel-news.com ã“ã®ã‚»ã‚ュリティ修æ£ãŒå…¥ã‚‹verã¯5.6.30ã¨5.5.42ã§ã™ã€‚ 5.6ã‹ã‚‰5.6.30ã¸ã®ã‚¢ãƒƒãƒ—グレード 記事ã«ã‚ˆã‚‹ã¨ã‚¢ãƒ—リケーションã®æš—å·åŒ–ã‚ーã§ã‚ã‚‹ APP_KEYãŒæ‚ªæ„ã®ã‚る第三者ã«æ¸¡ã£ã¦ã—ã¾ã£ãŸå ´åˆã«èµ·ãã‚‹ã¨ã„ã†äº‹ãªã®ã§ã€å¤§å‰æã¨ã—ã¦APP_KEYæµå¤±ã•ã›ãªã„ and ã‚‚ã—æµå¤±ã—ã¦ã—ã¾ã£ã¦ã„ã‚‹ãªã‚‰æš—å·åŒ–ã‚ー変更ã™ã‚‹ã‚ˆã†ã«ã—ã¦ä¸‹ã•ã„。 ãªãŠã€readoubleã§ã‚‚アップグレード方法ãŒæ—¥æœ¬èªžã§è¨˜è¼‰ã•ã‚Œã¦ã„ã‚‹ã®ã§ã“ã¡ã‚‰ã‚‚ã”覧下ã•ã„! アップグレードガイド 5.6 Laravel 以下ã¯LaravelNewsã®è¨˜äº‹ã®ç¿»è¨³ã¨ã‚¢ãƒƒãƒ—グレードガイドã®ç´¹ä»‹ã§ã™ã€‚ ã“ã®ç¿»è¨³è¨˜äº‹ã¯Laravel Newsã®é‹å–¶è€…ã§ã‚ã‚‹ã€Eric L. Barnesã•ã‚“ã«è¨±å¯ã‚’é ‚ã„ã¦ç¿»è¨³ã—ã¦ã„ã¾ã™ã€‚ 今æœç™ºè¡¨ã•ã‚ŒãŸlar
Detecting the use of "curl | bash" server side | Application Security
Installing software by piping from curl to bash is obviously a bad idea and a knowledgable user will most likely check the content first. So wouldn't it be great if a malicious payload would only render when piped to bash? A few people have tried this before by checking for the curl user agent which is by no means fail safe - the user may simply curl the url on the commandline revealing your malic
VAddyã§è¤‡æ•°FQDNã‚’ã¾ãŸãアプリケーションã®è„†å¼±æ€§æ¤œæŸ»ãŒå¯èƒ½ã«ï¼ - クラウド型Web脆弱性診æ–ツール VAddyブãƒã‚°
本日ã€è¤‡æ•°ã®FQDNã‚’ã¾ãŸãアプリケーションã®è„†å¼±æ€§æ¤œæŸ»æ©Ÿèƒ½ã‚’リリースã„ãŸã—ã¾ã—ãŸï¼ ã“ã‚Œã¾ã§ã®VAddyã§ã¯æ¤œæŸ»å¯¾è±¡ã¨ã—ã¦ç™»éŒ²ã§ãã‚‹ã®ã¯å˜ä¸€ã®FQDNã§æ§‹æˆã•ã‚ŒãŸWebアプリケーションã ã‘ã§ã—ãŸãŒã€æœ¬æ—¥ãƒªãƒªãƒ¼ã‚¹ã—ãŸæ©Ÿèƒ½ã«ã‚ˆã£ã¦è¤‡æ•°ã®FQDNã‹ã‚‰æ§‹æˆã•ã‚Œã¦ã„ã‚‹Webアプリケーションã®è„†å¼±æ€§æ¤œæŸ»ãŒå®Ÿç¾ã•ã‚Œã¾ã™ã€‚ ä¸è¦æ¨¡ä»¥ä¸Šã®Webアプリケーションã§ã¯æ©Ÿèƒ½ã”ã¨ã«FQDNãŒåˆ†ã‹ã‚Œã¦ã„るケースãŒå¤šãã‚ã‚Šã¾ã™ã€‚ 例ãˆã°ECサイトãªã©ã§è¦‹ã‚‰ã‚Œã‚‹ä»¥ä¸‹ã®ã‚ˆã†ãªã‚±ãƒ¼ã‚¹ã§ã™ã€‚ ãƒã‚°ã‚¤ãƒ³æ©Ÿèƒ½ï¼šlogin.example.com 会員ページ：mypage.example.com ã“ã‚Œã¾ã§ã®VAddyã§ã¯ã“ã®ã‚ˆã†ãªã‚¢ãƒ—リケーションã®è„†å¼±æ€§æ¤œæŸ»ã‚’è¡Œã†ã«ã¯ã€ãã‚Œãžã‚Œã®FQDNã§å€‹åˆ¥ã«æ¤œæŸ»ã‚’実行ã™ã‚‹å¿…è¦ãŒã‚ã£ãŸãŸã‚ã€åˆ¥FQDNã§æä¾›ã•ã‚Œã¦ã„ã‚‹ãƒã‚°ã‚¤ãƒ³æ©Ÿèƒ½ã‚’経由ã—ãªã„ã¨å‹•ä½œã—ãªã„アプリケーションã®æ¤œæŸ»ã¯ã§ãã¾ã›ã‚“ã§ã—ãŸã€‚
Postmortem for Malicious Packages Published on July 12th, 2018 - ESLint - Pluggable JavaScript Linter
ESLint v8.x reached end-of-life on 2024-10-05 and is no longer maintained. Upgrade or consider long-term support options Published 12 Jul, 2018 under Postmortems Postmortem for Malicious Packages Published on July 12th, 2018 Malicious versions of some ESLint packages were published (now unpublished) and we are sorry about this. We share details of the attack and our precautionary recommendations f
CloudFront Domain Hijacks under Attack
My blog has moved: https://vincentyiu.co.uk Update: To my attention in April, it appears that Mindpoint may have been behind the automated assigning of the hijackable instances. See https://www.mindpointgroup.com/blog/pen-test/cloudfront-hijacking/ This is great, but CloudFront’s engineers definitely missed a whole lot, so I’m not sure if they actually see the problem. Given that they have access
弊社WEB予約サービスã«å¯¾ã™ã‚‹ä¸æ£ã‚¢ã‚¯ã‚»ã‚¹ã«é–¢ã™ã‚‹æœ€çµ‚å ±å‘Šï½œä¹å·žå•†èˆ¹
2018å¹´3月30æ—¥ ãŠå®¢æ§˜ã€€å„ä½ ä¹å·žå•†èˆ¹æ ªå¼ä¼šç¤¾ 代表å–ç· å½¹ç¤¾é•·ã€€ç¾Žæ ¹ã€€æ™´å¹¸ ã“ã®åº¦ã€å¼Šç¤¾WEB予約サービスã«å¯¾ã™ã‚‹ä¸æ£ã‚¢ã‚¯ã‚»ã‚¹ã«ã¤ãã¾ã—ã¦ã¯ã€ãŠå®¢æ§˜ã«å¤šå¤§ãªã‚‹ã”心é…ã¨ã”迷惑をãŠæŽ›ã‘ã„ãŸã—ã¾ã—ãŸã“ã¨ã€æ·±ããŠè©«ã³ç”³ã—上ã’ã¾ã™ã€‚ 弊社ã§ã¯ã€ä»Šå›žã®ä¸æ£ã‚¢ã‚¯ã‚»ã‚¹ã«ã¤ãã¾ã—ã¦ã€ç¤¾å¤–ã®å°‚門家ã«ã‚ˆã‚Šæ§‹æˆã•ã‚Œã‚‹èª¿æŸ»å§”員会をè¨ç½®ã—ã€æœ¬ä»¶ä¸æ£ã‚¢ã‚¯ã‚»ã‚¹ã®äº‹å®Ÿé–¢ä¿‚ã®èª¿æŸ»ã€åŽŸå› 究明ã€ãŠå®¢æ§˜æƒ…å ±æ¼ãˆã„ã®è“‹ç„¶æ€§ã®è©•ä¾¡ã€å†ç™ºé˜²æ¢ç–ã®æ言ã«ã¤ã„ã¦èª¿æŸ»ã€æ¤œè¨Žã—ã¦ã¾ã„ã‚Šã¾ã—ãŸãŒã€ã“ã®åº¦ã€æœ€çµ‚çš„ãªå ±å‘Šæ›¸ã‚’å—é ˜ã„ãŸã—ã¾ã—ãŸã®ã§ã€ä¸‹è¨˜ã®é€šã‚Šã”å ±å‘Šã•ã›ã¦é ‚ãã¾ã™ã€‚ １．ä¸æ£ã‚¢ã‚¯ã‚»ã‚¹ã«é–¢ã™ã‚‹èª¿æŸ»ã«ã¤ã„㦠WEB予約サービスã«å¯¾ã—ã¦ç¬¬ä¸‰è€…ã«ã‚ˆã‚‹ä¸æ£ã‚¢ã‚¯ã‚»ã‚¹ãŒè¡Œã‚ã‚ŒãŸã“ã¨ãŒåˆ¤æ˜Žã—ã¦ãŠã‚Šã¾ã™ã€‚ 今回ã€ä¸æ£ã‚¢ã‚¯ã‚»ã‚¹ã®å¯¾è±¡ã¨ãªã£ãŸã‚µãƒ¼ãƒãƒ¼ã¯ã€WEB予約サービスをæä¾›ã—ã¦ã„るサーãƒãƒ¼ã§ã™ã€‚ 本システムã§ã¯ã€ãŠå®¢æ§˜æƒ…å ±ã¯WEBサーãƒãƒ¼ã«ã¯ä¿å˜ã›ãš
Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002 | Drupal.org
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being completely compromised. The security team has written an FAQ about this issue. Edited 2020, February 13 to fix links to patch files. Upgrade to the most recent version of Drupal 7 o
共通脆弱性評価システムCVSS v3概説 | æƒ…å ±ã‚»ã‚ュリティ | IPA 独立行政法人 æƒ…å ±å‡¦ç†æŽ¨é€²æ©Ÿæ§‹
CVSS(Common Vulnerability Scoring System) ～脆弱性ã®æ·±åˆ»åº¦ã‚’評価ã™ã‚‹ãŸã‚ã®æŒ‡æ¨™ï½ž 共通脆弱性評価システムCVSS(Common Vulnerability Scoring System)ã¯ã€æƒ…å ±ã‚·ã‚¹ãƒ†ãƒ ã®è„†å¼±æ€§ã«å¯¾ã™ã‚‹ã‚ªãƒ¼ãƒ—ンã§åŒ…括的ã€æ±Žç”¨çš„ãªè©•ä¾¡æ‰‹æ³•ã®ç¢ºç«‹ã¨æ™®åŠã‚’目指ã—ã€ç±³å›½å®¶ã‚¤ãƒ³ãƒ•ãƒ©ã‚¹ãƒˆãƒ©ã‚¯ãƒãƒ£è«®å•å§”員会(NIAC: National Infrastructure Advisory Council)ã®ãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã§2004å¹´10月ã«åŽŸæ¡ˆãŒä½œæˆã•ã‚Œã¾ã—ãŸã€‚ ãã®å¾Œã€CVSSã®ç®¡ç†æ¯ä½“ã¨ã—ã¦FIRST(Forum of Incident Response and Security Teams)ãŒé¸ã°ã‚Œã€FIRSTã®CVSS-SIG(Special Interest Group)(*1)ã§é©ç”¨æŽ¨é€²ã‚„仕様改善ãŒè¡Œã‚ã‚Œã¦ãŠã‚Šã€2005å¹´6月ã«CVSS v
ãƒãƒƒã‚«ãƒ¼ã«ç›—ã¾ã‚ŒãŸNEMã®è¡Œæ–¹ã€ãƒ›ãƒ¯ã‚¤ãƒˆãƒãƒƒã‚«ãƒ¼ãŒæ•æ‰ã—包囲網 - ã™ã¾ã»ã‚“!!
仮想通貨NEMãŒã€å›½å†…å–引所Coincheckã‹ã‚‰5å„„2300万XEMç›—ã¾ã‚ŒãŸã“ã¨ãŒã‚ã‹ã‚Šã¾ã—ãŸã€‚å–引所ãŒNEMをマルãƒã‚·ã‚°ã‚’掛ã‘ãšã«ãƒ›ãƒƒãƒˆã‚¦ã‚©ãƒ¬ãƒƒãƒˆã«ä¿ç®¡ã—ã¦ã„ãŸã“ã¨ãŒåŽŸå› ã§ã¯ãªã„ã‹ã¨è€ƒãˆã‚‰ã‚Œã¾ã™ã€‚ ã“ã®ç›—ã¾ã‚ŒãŸNEMã«ã¤ã„ã¦ã€ç¾åœ¨ãƒ›ãƒ¯ã‚¤ãƒˆãƒãƒƒã‚«ãƒ¼ãŒè¿½è·¡ä¸ã§ã™ã€‚ホワイトãƒãƒƒã‚«ãƒ¼ã¯NEMコミュニティã®æ—¥æœ¬äººé–‹ç™ºè€…ã§ã€NEMã®ãƒ¢ã‚¶ã‚¤ã‚¯ã¨ã„ã†ä»•çµ„ã¿ã‚’使ã„ã€ç›—難犯ã®ã‚¢ãƒ‰ãƒ¬ã‚¹ã‹ã‚‰ã®é€é‡‘ã«ãƒžãƒ¼ã‚ング。犯人ã®è¿½å°¾ã‚’è¡Œã£ã¦ã„ã¾ã™ã€‚ NEM財団ãŒã€æµå‡ºè³‡é‡‘自動追跡プãƒã‚°ãƒ©ãƒ ã®ä½œæˆã‚’開始ã—ã¾ã—ãŸã€‚ ãã®å®Œæˆã‚’å¾…ã¡å¼•ã継ãŽã‚’è¡Œã„ã€ä½œæ¥çµ‚了ã¨ã•ã›ã¦ã„ãŸã ãã¾ã™ã€‚ ãã‚Œã¾ã§ã¯ã€ã“ã¡ã‚‰ã§è¿½å°¾ã‚’続ã‘ã¾ã™ã€‚ — Rin, MIZUNASHI (JK17) (@minarin_) 2018å¹´1月26æ—¥ ãã‚‚ãã‚‚NEMã‚’å«ã‚€ä»®æƒ³é€šè²¨ã¯ãƒ–ãƒãƒƒã‚¯ãƒã‚§ãƒ¼ãƒ³ã€åˆ†æ•£åž‹å°å¸³æŠ€è¡“を用ã„ã¦ã„ã¾ã™ã€‚トランザクションã”ã¨ã®ãƒ–ãƒãƒƒã‚¯ãŒãƒãƒƒã‚·ãƒ¥ã«
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
「ã•ã‚ˆã†ãªã‚‰ ImageMagickã€ã®è€ƒå¯Ÿ - Qiita
IPAã®ITパスãƒãƒ¼ãƒˆè©¦é¨“申ã—è¾¼ã¿ã‚·ã‚¹ãƒ†ãƒ ã§å€‹äººæƒ…å ±ãŒæ¼æ´©ã€åŽŸå› ã¯æŽ’他制御ã®æ¬ è½ | 日経 xTECH（クãƒã‚¹ãƒ†ãƒƒã‚¯ï¼‰
Duo Finds SAML Vulnerabilities Affecting Multiple Implementations
GitHub - antonioribeiro/google2fa: A One Time Password Authentication package, compatible with Google Authenticator.
{{#tags}}- {{label}}
{{/tags}}