-
CVE-2023-22886: Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow JDBC Provider (30th June 2023)
Preface: Airflow is a platform to programmatically author, schedule, and monitor workflows. Specifically, it is used in Machine Learning to create pipelines. Background: Apache Airflow™ is an open-source platform for developing, scheduling, and monitoring batch-oriented workflows. This open-source platform most suitable for pipelines that change slowly, are related to a specific time interval, or are pre-scheduled.…
-
CVE-2023-21220: Outdated communication methods burden modern Androids (29th June 2023)
Preface: Since the official announcement did not contain details. Perhaps the situation describe here is one of the possible reasons for encountering such vulnerabilities. Background: SMS messages are sent in plain text. Rich Communications Services (RCS) is a communication protocol that will ultimately replace MMS and SMS messages on Android devices.Android Pie (codenamed Android P during development),…
-
Can you foresee how much AI and machine learning infrastructure there will be in the next few years? (28th June 2023)
Preface: ChatGPT Memory uses the Redis vector database to store an embedded conversation history of past user-bot interactions.The first interaction between the user and bot is critical to the user experience, said Microsoft.There are 1482 Companies currently using OpenAI, it also include Adobe and Schneider Electric. Background: ChatGPT, the full name of Chat Generation Pre-training…
-
CVE-2023-20892, CVE-2023-20893, CVE-2023-20894 and CVE-2023-20895, CVE-2023-20896: Double confirm to your admin, vcenter server has patch applied. (27th June 2023)
Preface: VMware published multiple vulnerabilities on 22nd June 2023. It make the reader dazzled. Since the actual attack exploit technique did not released by VMware.However they told vulnerability caused by DCEPRC. So, let us take a closer look of DCEPRC protocol. See whether it will lure your interest? Background: (DCERPC) Distributed Computing Environment / Remote…
-
About CVE-2023-32434, CVE-2023-32435 and CVE-2023-32439: When those vulnerabilities details shown, it made me think of a software (Redux) (25th June 2023)
Preface: The state in Redux is stored in memory. This means that, if you refresh the page the state gets wiped out. The state in redux is just a variable that persists in memory because it is referenced by all redux functions. Background: Safari is a web browser developed by Apple. It is built into…
-
CVE-2023-2431: Bypass of seccomp profile enforcement.About access control logic on cloud (22nd Jun 2023)
Preface: Information security driven role base access control. But when cloud service provider design or implement access control. It will be sophisticated. If access control include virtual machine technology under hierarchical structure. In order to harden the effectiveness of the control.Cloud resources are organised hierarchically, where the organisation node is the root node in the…
-
About CVE-2023-3220 An issue was discovered in the Linux kernel through 6.1-rc8 (20th June 2023)
Preface: AI Engines are built from the ground up to be software programmable and hardware adaptable. There are two distinct design flows for any developer to unleash the performance of these compute engines with the ability to compile in minutes and rapidly explore different microarchitectures.As of today, current technology are capable On-device intelligence powered by…
-
While IPv6 addresses the design limitations of IPv4. The Linux kernel says it takes time to adjust. (20th June 2023)
Preface: Why do I say on behalf of the Linux kernel that it takes time to adjust. If you recall, last year (December 2022), a flaw was found in fib6_rule_suppress() that would crash the kernel. According to the RedHat knowledge base, a resolution is in the works. That’s why I mentioned. Perhaps the website not…
-
About CVE-2023-33307: When a firewall or proxy encounters a null pointer dereference flaw, which part of its functionality is most likely to be affected? (19th June 2023)
Preface: Linux supports virtual memory, that is, using a disk as an extension of RAM so that the effective size of usable memory grows correspondingly. The kernel will write the contents of a currently unused block of memory to the hard disk so that the memory can be used for another purpose. Background: Linux supports…
-
About CVE-2023-32027, CVE-2023-32026, CVE-2023-32025, CVE-2023-29356, and CVE-2023-29349. Carefully observe and speculate on design weaknesses in ODBC and OLE DB remote code execution vulnerabilities. (June 16, 2023)
Preface: Since Microsoft didn’t provide details. In this example, no dangerous code is included, just my speculation about a design weakness in the ODBC Driver for SQL Server for this week’s Patch Tuesday. Background: Switch to the new Microsoft OLE DB Driver (MSOLEDBSQL) for SQL Server or the latest Microsoft ODBC Driver for SQL Server…