mailwal

You Could Be Checking the Wrong Copy of Your Software

Dave Wreski - Linux Security

The package you updated may not be the one an application is using. A certificate accepted by one program can be rejected by another, while an older web server keeps handling traffic inside a container.

This week’s findings point to the same blind spot: a quick version check or green status light cannot prove that the live software making security decisions has actually changed.

Yours in Open Source,

Dave Wreski's signature closing the article

Dave Wreski, Founder

When Uploading a File Can Put the Sender at Risk

Sending a file with curl can put the sender at risk when the receiving server is hostileIllustration of curl upload vulnerability risk. Researchers demonstrated a memory-handling flaw in HTTP/2 uploads that could let the server run code on the client. The proof of concept required precise knowledge of the victim’s curl build, system architecture, and memory layout, and no attacks against deployed systems are confirmed. Check applications and containers that bundle libcurl, not only the curl command installed on the host.

See which uploads, packages, and bundled copies need attention in Curl Vulnerability Can Let a Malicious Server Run Code During Uploads.

What If Two Applications Disagree About the Same Certificate?

A certificate can carry a valid signature and still name something its issuer was never allowed to certify.Image related to certificate name constraints issue CERT/CC collected cases where TLS libraries enforce those limits differently, including fixed, disputed and still-triaged reports. This is most relevant to teams running private certificate authorities or restricted intermediate authorities, not every encrypted connection. No active exploitation is reported; identify the library each application uses before assuming one successful certificate test represents the entire environment.

Understand which certificate setups and libraries deserve testing in What Is an X.509 Certificate, and Why Can TLS Libraries Disagree?

An Updated Host Can Still Be Serving an Old NGINX Build

NGINX fixed five medium-severity flaws across request handling, encrypted-session tickets, and several optional features. NGINX vulnerability and configuration version detailsNot every server reaches every vulnerable path, so the active configuration matters as much as the release number. No primary source reports active exploitation. Update through the supplier that provides the running build, then confirm old workers and container copies have stopped serving traffic; a patched host package does not prove those separate copies changed.

See which features and running copies need attention in NGINX Vulnerability Fixes Require More Than a Version Check.