장인테크 JanginTech

1. GitLab Patches Critical Authentication Bypass Vulnerabilityhttps://www.securityweek.com/gitlab-patches-critical-authentication-bypass-vulnerability/  [ 요약정리 ]GitLab Community Edition(CE) 및 Enterprise Edition(EE)에 대한 보안 업데이트가 출시되었으며, 인증 우회로 이어지는 심각한 취약점이 해결됐다. 문제는 CVE-2024-45409(CVSS 점수 10/10) 으로, SAML 기반 인증 GitLab CE/EE 인스턴스에 영향을 준다.XML 기반 마크업 언어인 SAML은 Ruby SAML 라이브러리를 사용하여 SAML 권한 부여의 클라이언트..

1. Linux xz and the Great Flaws in Open Sourcehttps://thenewstack.io/linux-xz-and-the-great-flaws-in-open-source/ Linux xz and the Great Flaws in Open SourceThe Linux xz utils backdoor exploit shows how vulnerable open source is to social engineering, said TesitfySec's John Kjell, speaking with Chris Pirillo in this episode of The New Stack Makers.thenewstack.io   [ 요약 ]1. Linux xz utils의 유지 관리자..

1. CVE-2023-42282: SSRF Vulnerability Found in ip Package for Node.js Before Version 1.1.9 Due to Improper Categorization of IP Addresseshttps://www.cve.news/cve-2023-42282/ CVE-2023-42282: SSRF Vulnerability Found in ip Package for Node.js Before Version 1.1.9 Due to Improper Categorization of IP AddSecurity researchers have recently discovered an SSRF (Server Side Request Forgery) vulnerabilit..