PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Audit of Cloud Native Buildpacks

blog.quarkslab.com | research | #cloud | #container-security | #vulnerability | #audit | #ostif | #cncf | #cloud-native-buildpacks
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Quarkslab's assessment of Cloud Native Buildpacks (OSTIF): eight vulnerabilities, from host compromise via overwritten trusted images to cross-app cache poisoning, privilege escalation and DoS.
Published
Collected

Related coverage

research · blog.quarkslab.com
Security audit of the Notary Project
Quarkslab audited the CNCF Notary Project for OSTIF, focusing on timestamping and CRL revocation added in v1.2.0/v1.3.0; findings include two CVEs and informational issues, all since addressed.
vulnerability · blog.quarkslab.com
MbedTLS Security Audit
At the request of the Open Source Technology Improvement Fund (OSTIF), Quarkslab performed a security audit of mbedTLS, evaluating the security of the changes in version 4.0.
blog · bishopfox.com
Zilliz / Attu | 2.6.5
Bishop Fox disclosed two flaws in Zilliz Attu 2.6.5, the Milvus management UI. An unauthenticated SSRF combined with a regex validation bypass chains into Kubernetes namespace takeover, exposing entire clusters to attackers.
blog · wiz.io
LiteLLM Compromised, Steals Credentials
# LiteLLM Compromised, Steals Credentials In a new incident, a malicious version (1.107.0) of the LiteLLM package was uploaded to PyPI and Docker on October 21. The malicious version includes a...
research · blog.quarkslab.com
Cortex Security Audit
Quarkslab audited Cortex, a multi-tenant Prometheus time-series store, for OSTIF: seven findings, including tenant impersonation via PushStream gRPC, were identified and all resolved.
research · blog.quarkslab.com
Extending LLVM's BOLT-based Binary Analyser to Validate Stack Variable Initialisation
Quarkslab extended LLVM's BOLT-based binary analyser for OSTIF with a scanner that validates -ftrivial-auto-var-init at the binary level, verifying stack-variable initialisation hardening.
Back