PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Security audit of the Notary Project

blog.quarkslab.com | research | #supply-chain | #audit | #ostif | #cncf | #notary | #cve-2024-56138
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Quarkslab audited the CNCF Notary Project for OSTIF, focusing on timestamping and CRL revocation added in v1.2.0/v1.3.0; findings include two CVEs and informational issues, all since addressed.
Published
Collected

Related coverage

research · blog.quarkslab.com
Audit of Cloud Native Buildpacks
Quarkslab's assessment of Cloud Native Buildpacks (OSTIF): eight vulnerabilities, from host compromise via overwritten trusted images to cross-app cache poisoning, privilege escalation and DoS.
research · blog.quarkslab.com
Cortex Security Audit
Quarkslab audited Cortex, a multi-tenant Prometheus time-series store, for OSTIF: seven findings, including tenant impersonation via PushStream gRPC, were identified and all resolved.
research · blog.quarkslab.com
Extending LLVM's BOLT-based Binary Analyser to Validate Stack Variable Initialisation
Quarkslab extended LLVM's BOLT-based binary analyser for OSTIF with a scanner that validates -ftrivial-auto-var-init at the binary level, verifying stack-variable initialisation hardening.
research · blog.quarkslab.com
Scala Security Audit
Quarkslab's security audit of Scala 3 for OSTIF: threat modeling, manual review, static analysis and fuzzing across the compiler, standard library, REPL, TASTy Inspector and doc generator.
research · blog.quarkslab.com
Paramiko Security Audit
Quarkslab's security audit of Paramiko for OSTIF covered the pure-Python SSHv2 library, its cryptography dependencies and rust-openssl bindings, entropy sources, constant-time code, testing and CI/CD.
research · blog.quarkslab.com
EVerest security audit
Quarkslab's first public security audit of EVerest, the open-source EV charging stack: 6 high, 6 medium and 5 low severity issues found, including RFID cloning and several DoS flaws.
Back