The previous post covered 12 to 18 August, this one covers 19 to 25. The format is unchanged: five things worth knowing, then two of them taken apart properly, because a CVE number and a CVSS score tell you nothing you can reuse and the mechanism usually does.
The previous post covered 5 to 11 August, this one covers 12 to 18. Same format: the five things worth knowing, then two taken apart, because the mechanism is the part you can generalise from.
This one covers 5 to 11 August, the next one covers 12 to 18. Same idea as always: what caught my attention in the Java ecosystem, then two items looked at properly, because the CVE number and the score are the least useful part of any of this. The mechanism is what you can carry to your own code.
Second week of this. The idea is the same as last time: list what caught my attention in the Java ecosystem, then pick two and look at the mechanism, because the CVE number and the score never tell you anything you can use.
I read a lot of security news and most of it is useless. Not wrong, just useless: a CVE number, a CVSS score, a vendor advisory link, “patch immediately”. You close the tab and you have learned nothing. The interesting part of a vulnerability is almost never the score, its the mechanism. How does a broker end up skipping an ACL check because you gave a destination the right kind of name? What happens when the library whose entire job is to answer yes or no gets equals() backwards?