2022년 03월 – 페이지 9 – 지락문화예술공작단

NGINX Tutorial: Protect Kubernetes Apps from SQL Injection

2022-03-23 KENNETH 0

NGINX Tutorial: Protect Kubernetes Apps from SQL Injection Note: This tutorial is part of Microservices March 2022: Kubernetes Networking. Reduce Kubernetes Latency with Autoscaling Protect Kubernetes APIs with Rate Limiting Protect Kubernetes Apps from SQL Injection (this post) Improve Uptime and Resilience with a Canary Deployment (coming soon) You work in IT for a popular local store that sells a variety of goods, from pillows to bicycles. They’re about to launch their first online store, but before launch they’ve asked a security expert to pen test the site before it goes public. Unfortunately, the security expert found a problem! The online store is vulnerable to SQL injection. The security expert was able to exploit the site to obtain sensitive information from your database, including usernames and passwords. Your team has come to you – the Kubernetes engineer – to save the day. [ more… ]

USN-5343-1: Linux kernel vulnerabilities

2022-03-23 KENNETH 0

USN-5343-1: Linux kernel vulnerabilities Yiqi Sun and Kevin Wang discovered that the cgroups implementation in the Linux kernel did not properly restrict access to the cgroups v1 release_agent feature. A local attacker could use this to gain administrative privileges. (CVE-2022-0492) It was discovered that the aufs file system in the Linux kernel did not properly restrict mount namespaces, when mounted with the non-default allow_userns option set. A local attacker could use this to gain administrative privileges. (CVE-2016-2853) It was discovered that the aufs file system in the Linux kernel did not properly maintain POSIX ACL xattr data, when mounted with the non-default allow_userns option. A local attacker could possibly use this to gain elevated privileges. (CVE-2016-2854) It was discovered that the f2fs file system in the Linux kernel did not properly validate metadata in some situations. An attacker could use [ more… ]

[도서] 그림과 실습으로 배우는 도커 & 쿠버네티스

2022-03-23 KENNETH 0

[도서] 그림과 실습으로 배우는 도커 & 쿠버네티스 분야별 신상품 – 국내도서 – 컴퓨터와 인터넷 [도서]그림과 실습으로 배우는 도커 & 쿠버네티스 오가사와라 시게타카 저/심효섭 역 | 위키북스 | 2022년 04월 판매가 25,200원 (10%할인) | YES포인트 1,400원(5%지급) 컨테이너나 도커를 도통 이해하기 어려운 분들을 위한 본격 도커 입문서! 이 책은 컨테이너 기술이 어렵게 느껴지는 엔지니어나 백엔드 기술에 자신이 없는 분들을 위한 도커 입문서다. 자세한 그림과 친절한 실 Source: [도서] 그림과 실습으로 배우는 도커 & 쿠버네티스

USN-5340-1: CKEditor vulnerabilities

2022-03-23 KENNETH 0

USN-5340-1: CKEditor vulnerabilities Kyaw Min Thein discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affects Ubuntu 18.04 LTS. (CVE-2018-9861) Micha Bentkowski discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affects Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-9281) Anton Subbotin discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affects Ubuntu 21.10. (CVE-2021-32808) Anton Subbotin discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to inject arbitrary code. (CVE-2021-32809) Or Sahar discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affects Ubuntu 18.04 LTS and [ more… ]

USN-5341-1: GNU binutils vulnerabilities

2022-03-22 KENNETH 0

USN-5341-1: GNU binutils vulnerabilities It was discovered that GNU binutils incorrectly handled checks for memory allocation when parsing relocs in a corrupt file. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-17122) It was discovered that GNU binutils incorrectly handled certain corrupt DWARF debug sections. An attacker could possibly use this issue to cause GNU binutils to consume memory, resulting in a denial of service. (CVE-2021-3487) It was discovered that GNU binutils incorrectly performed bounds checking operations when parsing stabs debugging information. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2021-45078) Source: USN-5341-1: GNU binutils vulnerabilities