PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Scala Security Audit

blog.quarkslab.com | research | #appsec | #vulnerability-research | #fuzzing | #security-audit | #static-analysis | #compiler | #ostif | #scala
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Quarkslab's security audit of Scala 3 for OSTIF: threat modeling, manual review, static analysis and fuzzing across the compiler, standard library, REPL, TASTy Inspector and doc generator.
Published
Collected

Related coverage

research · blog.quarkslab.com
State of Post-Quantum Cryptography implementations
In this blogpost, we first review the landscape of Post-Quantum Cryptography implementations across some of the most popular cryptographic libraries. Following that, we present the results of a differential fuzzing campaign on few of the presented implementations.
research · blog.quarkslab.com
Security audit of PHP-SRC
Quarkslab's security audit of PHP-SRC ahead of PHP 8.4, funded via OSTIF and the Sovereign Tech Fund: reviewing FPM, JSON, OpenSSL and CSPRNG code plus SAST and fuzzing tooling.
research · blog.quarkslab.com
Security Assessment of OpenVPN
OSTIF-funded security assessment of OpenVPN 2.4.0: 50 man-days of code and cryptography review that uncovered pre-auth and post-auth DoS bugs (CVE-2017-7478/7479) plus an info leak, fixed in 2.4.2.
research · blog.quarkslab.com
Security Assessment of VeraCrypt: fixes and evolutions from TrueCrypt
VeraCrypt 1.18 security assessment: verifying fixes inherited from TrueCrypt and auditing new features (UEFI, extra ciphers); a critical cryptography flaw introduced in 1.18 was fixed in 1.19.
research · slcyber.io
How practical is 100k requests per second? Introducing h3fuzz
Can HTTP/3 really give you 100k requests per second for content discovery? We tested it in a fork of ffuf and are releasing h3fuzz, a web UI for fuzzing.
research · blog.quarkslab.com
Cortex Security Audit
Quarkslab audited Cortex, a multi-tenant Prometheus time-series store, for OSTIF: seven findings, including tenant impersonation via PushStream gRPC, were identified and all resolved.
Back