Critical OpenSSL Vuln, SQLite Vuln, Apple Security Blog, Randomness & Shuffling – ASW #218

The last critical advisory seems to have been from 2016 and Heartbleed is about eight years old. So, even though this Tuesday promises to be a headache for orgs running OpenSSL version 3.0+, it's nice to see that the work going into maturing the code base seems to be paying off.

OpenSSL 3.0 has been out for just over a year, having been released in September 2021.

What's more interesting will be to watch the upgrade path and rate of adoption since version 1.1.1 has less than a year of support left.

SQLite has one of the most comprehensive and high coverage approaches to testing. So when we highlight a vuln in this relatively ubiquitous software, it's helpful to point out how rare the vulns tend to be and how much diligence the project puts into not only coverage of code, but the various types of testing it conducts. This vuln doesn't seem likely to lead to mass exploitation given the prerequisites for triggering it.

This one has path traversal (yay!) and a handful of other vulns that hit a bunch of the OWASP Top 10 items, which makes the list of CVEs stand out as impressive for modern software.

A deep dive into hardening Apple's kernel against memory safety issues. Even if you're not interested in C or macOS internals, the article provides a great overview of a taxonomy of memory safety issues and how Apple has been thinking about countering this attack class.

Apple joins the ranks of companies highlighting how much they've spent on identifying vulns through the efforts of communities of researchers. As with all of these types of articles, I'm always curious what the money spent to fix the vulns looks like.

Another article that steps a little outside the usual software we focus on, but it touches on security testing for random number generators, adversarial users that make for fun threat models, and the impacts -- measurable in dollars in this case -- of insecure software.

This could be interesting - Docker announced support for running WASM apps - without having to build a container, but instead use the WasmEdge runtime. Will this be the beginning of the end for containers? (hasn't happened to VMs yet...)