Risky Biz News: Supply chain attack in Linuxland
In other news: AT&T confirms 2019 data breach; Canonical switches to manual reviews after flood of scam apps; HP leaves Russia.
Introducing Ruzzy, a coverage-guided Ruby fuzzer
blog.trailofbits.comTrail of Bits is excited to introduce Ruzzy, a coverage-guided fuzzer for pure Ruby code and Ruby C extensions. Fuzzing helps find bugs in software that processes untrusted input. In pure Ruby, these bugs may result in unexpected exceptions that could lead to denial of service, and in Ruby C extensions, they […]
Sign in as anyone: Bypassing SAML SSO authentication with parser differentials
Critical authentication bypass vulnerabilities were discovered in ruby-saml up to version 1.17.0. See how they were uncovered.
Campagne internationale pour la sécurité informatique : audit automatique des projets
La Maison-Blanche demande un audit sur la sécurité des logiciels open source. Partie 2/3 : audit automatique des projets.