PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Cortex Security Audit

blog.quarkslab.com | research | #open-source | #access-control | #security-audit | #audit | #ostif | #prometheus | #multi-tenancy | #tenant-isolation
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Quarkslab audited Cortex, a multi-tenant Prometheus time-series store, for OSTIF: seven findings, including tenant impersonation via PushStream gRPC, were identified and all resolved.
Published
Collected

Related coverage

research · blog.quarkslab.com
Security Assessment of OpenVPN
OSTIF-funded security assessment of OpenVPN 2.4.0: 50 man-days of code and cryptography review that uncovered pre-auth and post-auth DoS bugs (CVE-2017-7478/7479) plus an info leak, fixed in 2.4.2.
research · blog.quarkslab.com
Security Assessment of VeraCrypt: fixes and evolutions from TrueCrypt
VeraCrypt 1.18 security assessment: verifying fixes inherited from TrueCrypt and auditing new features (UEFI, extra ciphers); a critical cryptography flaw introduced in 1.18 was fixed in 1.19.
blog · about.gitlab.com
GitLab compliance frameworks: Adhere to SOC 2 in minutes
This coverage helps security and compliance teams streamline SOC 2 pipeline guardrails and evidence collection.
research · blog.quarkslab.com
Extending LLVM's BOLT-based Binary Analyser to Validate Stack Variable Initialisation
Quarkslab extended LLVM's BOLT-based binary analyser for OSTIF with a scanner that validates -ftrivial-auto-var-init at the binary level, verifying stack-variable initialisation hardening.
research · blog.quarkslab.com
Scala Security Audit
Quarkslab's security audit of Scala 3 for OSTIF: threat modeling, manual review, static analysis and fuzzing across the compiler, standard library, REPL, TASTy Inspector and doc generator.
research · blog.quarkslab.com
Paramiko Security Audit
Quarkslab's security audit of Paramiko for OSTIF covered the pure-Python SSHv2 library, its cryptography dependencies and rust-openssl bindings, entropy sources, constant-time code, testing and CI/CD.
Back