January 2022 Summaries

CVE-2022-0185 is a critical vulnerability in Linux kernel versions 5.1 to 5.16.1, caused by an integer underflow in the Filesystem Context module, which can lead to privilege escalation, container environment escape, or denial of service. Discovered through Google's KCTF bug bounty program, it allows a local attacker to execute arbitrary code in the kernel context. The vulnerability's exploitation requires the CAP_SYS_ADMIN capability, often available in Kubernetes environments, making it particularly concerning for self-managed deployments like Amazon EKS, Azure AKS, and Google GKE. While some Kubernetes engines have released updates to mitigate the issue, others like GKE are still pending fixes. To remediate outside Kubernetes, upgrading to Linux kernel version 5.16.2 or applying a patch is advised, alongside limiting privileged containers and disabling unprivileged user namespaces as a mitigation strategy. With exploitation methods already published, this vulnerability poses a significant threat, and staying updated with security patches and advisories is crucial for affected systems.

Modern software projects heavily rely on open-source code, raising concerns about control and security, particularly highlighted by incidents like the Log4Shell vulnerability and the intentional corruption of popular npm packages, colors and faker, by their maintainer. These events underscore the risks associated with blindly trusting code from public repositories, as developers might inadvertently integrate malicious code. The limitations of npm's package management, such as its failure to honor package-lock.json when installing packages globally, further exacerbate these vulnerabilities. In response, the JFrog Security Research team has developed open-source tools like package_checker, npm-secure-installer, and package_issues_history to help detect and prevent the installation of potentially faulty npm packages and to secure the development workflow. These tools aim to bolster security in the software supply chain by providing mechanisms to verify package integrity and by monitoring for problematic updates, thus offering a proactive approach to managing dependencies and reducing the risk of malicious code execution.

JFrog's journey from a small team of 15 to over 1,000 employees across 15 countries exemplifies the company's commitment to building a strong organizational culture and community. Central to their growth is the JFrog Codex, an employee-driven document guiding their collective ethos and values, ensuring that as they scale, the essence of their culture remains intact. This culture, which transcends typical tech company perks, emphasizes universal values like thinking big and customer happiness, encouraging personal and professional growth among employees, referred to as "Frogs." The company has successfully navigated major milestones, including an IPO during the pandemic, by maintaining a focus on why they do what they do, fostering inclusivity and togetherness even in challenging times. Through strategic acquisitions and a strong sense of community, JFrog continues to thrive with the belief that building the company right requires unwavering commitment to its people and values.

With the rise of software supply chain attacks, securing development environments through DevSecOps practices in air-gapped setups is increasingly critical, involving the separation of internal networks from external ones to enhance security. An air-gapped solution, while providing stricter security, requires comprehensive measures such as scanning third-party dependencies for vulnerabilities and license violations using tools like JFrog Xray. This setup involves installing Xray in both the internal network and an external DMZ to ensure continuous scanning of artifacts and leveraging JFrog CLI for updating the Xray database with the latest vulnerability intelligence. The process includes differentiating between policies on the DMZ and internal environments, using a duplicated staging environment for testing, and managing dependencies through an identity-based solution that tracks requests and approvals. The approach not only facilitates auditing and scalability but also integrates the SecOps team seamlessly while automating processes for developers, although it demands robust automation and active SecOps involvement.

In 2021, JFrog extensively covered DevSecOps topics in response to the growing importance of security in software development, culminating in a "Best of 2021" post highlighting key insights and discoveries. The blog series addressed new vulnerabilities identified by JFrog's security research team, such as malicious packages in PyPI and npm repositories, and explored significant issues like the log4j vulnerability and the critical role of the Software Bill of Materials (SBOM) in securing the Software Development Life Cycle (SDLC). It offered practical advice on evaluating DevSecOps products, protecting against supply chain attacks, and improving vulnerability disclosure processes. Additionally, JFrog shared detailed analyses of specific security threats like the INFRA:HALT vulnerabilities in NicheStack and provided guides on using tools like Xray for software composition analysis and Artifactory in air-gapped environments.

JFrog has appointed Meerah Rajavel, a seasoned technology leader with extensive experience in enterprise software, cybersecurity, and business transformation, to its Board of Directors as part of its strategy for global growth and leadership in the DevOps and DevSecOps markets. Meerah's career has been shaped by various mentors and personal influences, including her family and professional colleagues, and she advocates for diversity and female representation in IT leadership roles. She emphasizes the importance of DevSecOps as an integral framework for incorporating security throughout the software development process, responding to vulnerabilities such as the Log4j incident by recommending practices like Software Composition Analysis (SCA) and Software Bill of Materials (SBOM). Meerah also highlights the significance of aligning business objectives with digital transformations, focusing on people, processes, and technology to drive successful change. As companies navigate an evolving threat landscape, she underscores the necessity of securing the software supply chain and the role of binary management in mitigating risks, especially in the context of the increasing prevalence of remote work environments.

JFrog has launched a new Community site aimed at providing a comprehensive resource hub for developers across various programming languages, with an emphasis on DevOps, DevSecOps, and cloud-native technologies. This platform offers seven distinct entry points to cater to diverse learning preferences, covering topics such as Cloud-Native, DevOps, DevSecOps, and language-specific content for Java, Go, and C++. The site is designed to facilitate quick access to information and includes features like event listings, hands-on workshops, and direct links to JFrog's extensive library of open-source software and tools, including IDE, build, and product integrations. As JFrog's offerings expand, the site will continue to grow, aiming to support developers in becoming more successful and efficient.

The JFrog Security Research Team recently identified a critical vulnerability in the H2 database console, designated as CVE-2021-42392, which shares the same root cause as the infamous Log4Shell vulnerability but is less widespread due to its direct impact scope. The H2 database, a popular Java SQL database used in many projects, was found to be vulnerable to remote code execution (RCE) through JNDI remote class loading. By default, the H2 console listens only to localhost, making the default setting safe; however, the console can be configured to allow remote connections, posing a significant risk if exposed to wide area networks (WAN). The vulnerability, found in the JdbcUtils.getConnection method, passes unfiltered attacker-controlled URLs that can lead to remote code execution. Although several attack vectors were identified, the most severe involves the H2 console, which can be accessed without authentication under certain configurations. The vulnerability was promptly addressed by the H2 maintainers, who released version 2.0.206 to fix the issue by restricting JNDI URLs to local protocols, similar to the fix applied in Log4j 2.17.0. Users are strongly advised to upgrade to this version to mitigate the risk. The research underscores the importance of securing developer tools and vigilance against potential supply chain attacks exploiting similar JNDI vulnerabilities.

JFrog highlights the crucial role of binary management in the modern DevOps landscape, emphasizing its necessity for digital transformation and successful software delivery. Initially pioneering DevOps with a focus on binaries, JFrog notes the evolution from source code-centric approaches to a binary-driven software supply chain, asserting that binaries are now central to automation, security, and deployment processes. Despite the buzz around DevSecOps, the integration of security remains fragmented, with a call for a unified approach that centers on securing binaries to protect organizations. The text also underscores the shift towards hybrid cloud deployments and the increasing importance of edge computing, predicting that 2022 will witness a significant expansion in binary management practices. This shift is essential for adapting to industry demands, enabling companies to automate and secure their software supply chains effectively, with binaries serving as the core asset for competitive differentiation in the tech landscape.

Cloud computing has become the standard for modern enterprises, emphasizing the need for systems not only to be cloud-native but also cloud-nimble, allowing for operational consistency and flexibility across multiple cloud environments. As organizations increasingly adopt hybrid and multi-cloud architectures, they seek to avoid vendor lock-in and achieve greater agility, with 59% of enterprises using a hybrid mix of private and public clouds. The JFrog DevOps Platform exemplifies a cloud-nimble solution by offering a consistent operating model across on-prem, cloud, and hybrid environments, empowering enterprises to distribute workloads across different cloud providers according to specific needs while maintaining robust security and governance. This approach allows enterprises to innovate faster, optimize costs, and maintain a consistent security posture, facilitating seamless cloud migrations and uninterrupted operations.

JFrog Artifactory serves as a private Docker registry that facilitates the storage, sharing, and deployment of binary artifacts while integrating smoothly with Kubernetes to pull images and scale applications. The guide discusses setting up Artifactory within a Kubernetes environment, emphasizing the importance of cluster-wide authenticated access to Artifactory and detailing the process of authenticating Kubernetes with a private Docker registry using Kubernetes secrets. It highlights the benefits of using tools like the imagepullsecrets-patcher to streamline cluster-wide access across namespaces, thereby eliminating the need for repetitive secret creation and configuration. Additionally, the text introduces advanced features like AWS AssumeRole integration for enhanced security and mentions the potential use of Kubernetes' dynamic credential retrieval feature for container image registries, indicating a shift towards more secure and automated secret management practices.