Read Time:6 Second
A supply chain attack on the Solana library utilizing malicious npm versions has exposed private keys, putting crypto funds at risk
Daily Archives: December 5, 2024
python-virtualenv-20.21.1-14.el9
Read Time:9 Second
FEDORA-EPEL-2024-08d8c17c5d
Packages in this update:
python-virtualenv-20.21.1-14.el9
Update description:
Security fix for CVE-2024-53899
Fix for virtualenv –seeder pip –python=python3.12
USN-7117-3: needrestart regression
Read Time:57 Second
USN-7117-1 fixed vulnerabilities in needrestart. The update introduced a
regression in needrestart. This update fixes the problem for LXC
containers.
We apologize for the inconvenience.
Original advisory details:
Qualys discovered that needrestart passed unsanitized data to a library
(libmodule-scandeps-perl) which expects safe input. A local attacker could
possibly use this issue to execute arbitrary code as root.
(CVE-2024-11003)
Qualys discovered that the library libmodule-scandeps-perl incorrectly
parsed perl code. This could allow a local attacker to execute arbitrary
shell commands. (CVE-2024-10224)
Qualys discovered that needrestart incorrectly used the PYTHONPATH
environment variable to spawn a new Python interpreter. A local attacker
could possibly use this issue to execute arbitrary code as root.
(CVE-2024-48990)
Qualys discovered that needrestart incorrectly checked the path to the
Python interpreter. A local attacker could possibly use this issue to win
a race condition and execute arbitrary code as root. (CVE-2024-48991)
Qualys discovered that needrestart incorrectly used the RUBYLIB
environment variable to spawn a new Ruby interpreter. A local attacker
could possibly use this issue to execute arbitrary code as root.
(CVE-2024-48992)
Russian money-laundering network linked to drugs and ransomware disrupted, 84 arrests
Read Time:15 Second
The UK’s National Crime Agency (NCA) has revealed details of Operation Destabilise, a years-long international law enforcement investigation into a giant Russian money laundering enterprise that handled billions of dollars for drug traffickers and ransomware gangs worldwide.
Read more in my article on the Tripwire State of Security blog.
Veeam Urges Immediate Update to Patch Severe Vulnerabilities
Read Time:5 Second
Veeam has released patches for critical VSPC flaws, requiring immediate attention from affected service providers
12 CIS Experts’ Cybersecurity Predictions for 2025
Read Time:8 Second
We spoke to a dozen experts at the Center for Internet Security® (CIS®) about their cybersecurity predictions for 2025. Here’s what they had to say.
python3.13-3.13.1-1.fc40
Read Time:42 Second
FEDORA-2024-be6ea1ce44
Packages in this update:
python3.13-3.13.1-1.fc40
Update description:
This is the first maintenance release of Python 3.13
Python 3.13 is the newest major release of the Python programming language, and it contains many new features and optimizations compared to Python 3.12. 3.13.1 is the latest maintenance release, containing almost 400 bugfixes, build improvements and documentation changes since 3.13.0.
Security content in this release
gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to consistently use the mapped IPv4 address value for deciding properties. Properties which have their behavior fixed are is_multicast, is_reserved, is_link_local, is_global, and is_unspecified.
CVE-2024-9287: gh-124651: Properly quote template strings in venv activation scripts.
gh-125140: Remove the current directory from sys.path when using PyREPL.
python3-docs-3.13.1-1.fc41 python3.13-3.13.1-1.fc41
Read Time:44 Second
FEDORA-2024-3c18fe0d93
Packages in this update:
python3.13-3.13.1-1.fc41
python3-docs-3.13.1-1.fc41
Update description:
This is the first maintenance release of Python 3.13
Python 3.13 is the newest major release of the Python programming language, and it contains many new features and optimizations compared to Python 3.12. 3.13.1 is the latest maintenance release, containing almost 400 bugfixes, build improvements and documentation changes since 3.13.0.
Security content in this release
gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to consistently use the mapped IPv4 address value for deciding properties. Properties which have their behavior fixed are is_multicast, is_reserved, is_link_local, is_global, and is_unspecified.
CVE-2024-9287: gh-124651: Properly quote template strings in venv activation scripts.
gh-125140: Remove the current directory from sys.path when using PyREPL.
USN-7139-1: Apache Shiro vulnerability
Read Time:11 Second
It was discovered that Apache Shiro used a static cipher within the
“Remember Me” feature inside authentication by default. An attacker could
possibly use this issue to achieve remote code execution or obtain
sensitive information.
FBI Warns GenAI is Boosting Financial Fraud
Read Time:6 Second
An FBI alert warned that GenAI tools are improving the believability of fraud schemes and enabling large scale attacks