CVE posting, but like, going on a tangent
The CVE: 2024
The linked Phabricator task: 2023
The task it was split off from: 2022
wat?
CVE posting, but like, going on a tangent
And while looking at stuff I realized that the list of GHSAs is also just visible so.…
CVE posting, but like, going on a tangent
This is the 2024 edition of "I posted the private key in chat"
CVE posting, but like, going on a tangent
"security vulnerability in Apache Submarine"
wtf is Apache Submarine now?
Apache Submarine. Cloud Native Machine Learning Platform.
a
CVE posting, but like, going on a tangent
typo3 seems to have had a fun June.
CVE posting, but like, going on a tangent
Magento and Shopware also never disappoint when it comes to security /hj
(I am so glad not to work in eCommerce any longer)
CVE posting, but like, going on a tangent
Okay, so with Magento, Shopware, Drupal, Typo3, PrestaShop, Symfony, and Laravel I feel like you could've had a lot of fun the past two months. The only eCommerce platform I didn't see is OXID (which didn't have any CVEs since 2023 it seems). But yeah, that should've hit a lot of stuff.
CVE posting, but like, going on a tangent
This is so funny to me: https://github.com/advisories?query=severity%3Acritical+type%3Areviewed+jwt+none
And that's only the critical ones, there is more under high it seems.
CVE posting, but like, going on a tangent
ahhhh, yes.…
At this point I'm just laughing at everything I find.…
CVE posting, but like, going on a tangent
tasty PBKDF2 with a single iteration 
CVE posting, but like, going on a tangent
phpmyadmin contains SQL Injection vulnerability
works as intended I guess 🤡 /j
CVE posting, but like, going on a tangent
PyMySQL SQL Injection vulnerability
I repeat: works as intended I guess 🤡 /j
CVE posting, but like, going on a tangent
CVE posting, but like, going on a tangent
Okay, looking at the CERT Bund site and filtering for critical stuff without mitigation is funny.
The list goes: D-LINK, Linksys, Linksys, D-LINK, D-LINK, something else, D-LINK, D-LINK
CVE posting, but like, going on a tangent
Let's talk about SnailLoad (CVE-2024-39920) for a second, shall we?
So it turns out, if you download something from a server that affects your bandwidth and potentially latency, and anything your computer is connected to could potentially detect if your current network load changes (i.e. Steam starts or stops downloading a big game or whatever).
This probably has practical implications.… unless you are me, have asymmetric routing which already obscures a lot, one internet connection which already has varying latency (thanks cable), and a constant network load of at least 1Mbit/s with irregular but frequent peaks, because yes of course we have about twenty services hosted from this flat.
I think it's very interesting that you can see the variation in latency on the other side, but at the same time I'm not sure whether any of this is practical for virtually anything at least in this country.
Considering Germany has shoddy internet at best, you wouldn't be able to tell if it's me opening a video, or my neighbour, or maybe Vodafone forgot to use more than a single Gigabit uplink for the entirety of Berlin (again). Who knows?
Is this security through obscurity? Yes.
Do I think any of this matters?
Well, not really, at least not until we all have good internet connections (Gigabit and upwards, I'm not talking about the sad reality of maybe raising speeds from 10 to 15 mbit/s) that can actually be saturated because we have the capacity, but that's not gonna happen within my lifetime (at least not on a larger scale).
CVE posting, but like, going on a tangent
@benaryorg FWIW, I'm on gbit fiber, and at first I thought the demo was broken - it barely rendered any observable latency for me
