April 2022 Summaries

DevSecOps is an essential practice aimed at embedding security into the DevOps workflow to create more secure applications, safeguard the software supply chain, and protect cloud and on-premises workloads. The "DevSecOps 101" webinar series provides guidance on integrating this practice by balancing application security with development speed and reliability, allowing development teams to secure their work without hindrance and facilitating quick remediation. It emphasizes the synchronization of security, development, and operations throughout the software development lifecycle while providing practical examples to help individuals start their own DevSecOps journey. The webinar highlights the importance of integrating security into the CI/CD pipeline and introduces tools like the JFrog Xray SCA to illustrate the benefits and necessity of incorporating security into the DevOps culture.

SwampUP 2022, hosted by JFrog, is an in-person DevOps and DevSecOps conference scheduled for May 25-26 at the Omni La Costa Resort & Spa in Carlsbad, California, offering a wide array of sessions, training, and networking opportunities. Attendees can expect to hear keynotes from industry leaders, including JFrog CTO Yoav Landman, and gain insights from companies like Netflix, Google, and Microsoft. The conference covers a variety of topics such as DevOps trends, cloud-native deployments, CI/CD automation, and security best practices, with hands-on training sessions available for deeper learning and certification. Participants can explore the latest developments in DevOps through interactive sessions and workshops, including discussions on topics like supply chain security, automation with Kubernetes, and software distribution patterns. Additionally, the event provides opportunities for networking and collaboration among industry peers, with special events like cocktail hours and a gala to facilitate connections. The conference prioritizes attendee health and safety with COVID-19 protocols and offers special accommodation rates for participants.

Neil Madden's blog post highlights a critical vulnerability in Java, known as CVE-2022-21449 or "Psychic Signatures," stemming from an improper implementation of the ECDSA signature verification algorithm in Java versions 15 and above. This flaw allows attackers to potentially intercept encrypted communications and bypass authentication by exploiting the signature validation process, which fails to ensure the integrity of r and s values in ECDSA signatures. The vulnerability affects applications utilizing Java's getInstance() API with ECDSA algorithms, compromising content integrity validation. To mitigate the risk, upgrading to the latest Java versions is recommended, and for those unable to upgrade, alternative signature algorithms like EdDSA or Ed25519 are suggested. JFrog Xray offers tools to identify the vulnerability in code, and JFrog's internal inspection confirmed their DevOps platform is not affected by this issue.

JFrog's approach to software security emphasizes the importance of distinguishing between real threats and false positives, which can waste valuable time for developers and security teams. Their Xray tool enhances vulnerability scanning by supplementing the Common Vulnerabilities and Exposures (CVE) database with enriched data and contextual analysis, allowing teams to focus on genuine risks. The JFrog Security Research Team provides a proprietary severity ranking system that evaluates the potential for real-world exploitation, while offering detailed insights into each threat. This approach helps organizations prioritize the remediation of vulnerabilities, ensuring that resources are directed towards addressing critical security gaps. By filtering out less relevant threats, JFrog allows security teams to concentrate on significant issues, thereby maintaining the integrity and trust in their software systems.

swampUP, taking place on May 25-26 in San Diego, is a DevOps conference hosted by JFrog that offers two days of learning, networking, and hands-on activities aimed at enhancing participants' skills with a focus on practical applications of JFrog's products. The event features various training sessions, including advanced courses on JFrog Artifactory and cloud-native DevOps, as well as introductions to DevSecOps with JFrog Xray and SBOM management. Attendees can also engage in interactive experiences such as Hackergarten and Capture the Frog, and learn from leading DevOps practitioners from companies like Netflix, Volvo, Google, and AWS. The conference offers opportunities for networking at events like the DevOps Speakeasy and a Gala Event, with a discount available for those who book using a special code.

Recent updates to Go versions 1.18.1 and 1.17.9 have addressed a stack overflow vulnerability in the encoding/pem package's Decode function, known as CVE-2022-24675. This vulnerability, which has existed for at least eight years, can cause a Denial of Service (DoS) when the Decode function processes a large buffer with malformed PEM data. Although exploiting the vulnerability requires specific conditions, the process itself is straightforward, potentially disrupting targeted applications. The vulnerability affects all Go versions up to 1.18.0 or 1.17.8, particularly those using the Decode function for malformed data. The issue arises from a recursive call to the Decode function, leading to stack exhaustion, and has been patched by removing this recursion. While the JFrog DevOps platform is not affected, users are advised to upgrade to the latest Go versions or apply the patch to mitigate the risk. JFrog continues to offer security insights and automated vulnerability scanning for developers through its JFrog Xray tool and security research updates.

Multi-cloud DevOps, incorporating both cloud and on-premises elements, is increasingly recognized as the future of development and deployment, offering benefits like performance optimization, avoiding vendor lock-in, and leveraging diverse tools from multiple cloud providers. To assist organizations in implementing multi-cloud strategies, JFrog has organized a free coffee break series led by Sr. Solution Engineer Bill Manning, covering essential topics such as selecting the right multi-cloud topology, utilizing JFrog Platform tools for hybrid architectures, and understanding multi-cloud distribution to overcome network challenges. These sessions aim to provide practical insights into effective multi-cloud adoption, with recordings available for those unable to attend live. Additionally, JFrog's swampUP conference offers further opportunities for learning and networking, featuring sessions on DevOps and DevSecOps, hands-on training, and unique events like the Hackergarten and DevOps Speakeasy, set to take place in San Diego on May 25 and 26, with discounts available for early registration.

Frogbot is a new addition to the JFrog ecosystem, designed to enhance the security of git projects by scanning pull requests for vulnerabilities using JFrog Xray, thereby preventing new security risks from being introduced into the codebase. Integrated with platforms like GitHub, GitLab, and Bitbucket Server, Frogbot reports its findings as comments within the git user interface, allowing developers to address issues before merging. It supports tools such as Npm, Maven, Gradle, and more for dependency management. In addition to Frogbot, JFrog offers various open-source tools for developers, including JFrog CLI, IDE integrations, and build integrations with popular CI systems, all aimed at identifying and mitigating security vulnerabilities early in the development process. Frogbot is open-source, encouraging contributions from the community to further improve its functionality.

The rapid evolution of technology has led to a hyper-connected world where billions of active endpoints, such as 5G stations, vehicles, and IoT devices, require sophisticated software management and deployment strategies. JFrog addresses these challenges by providing an integrated DevOps platform designed to streamline software delivery, enhance security, and ensure compliance across globally distributed teams. By integrating development, security, and operations best practices, JFrog's platform offers a holistic solution to manage the software supply chain, enabling quick, secure releases and supporting the shift towards digital transformation. This platform's flexibility, openness, and expandability make it suitable for current and future applications, providing businesses the tools needed to maintain competitive advantage in an increasingly complex digital landscape.

A study by the University of Maryland's Clark School of Engineering revealed that hacker attacks occur every 39 seconds on average, underscoring the pervasive threat of cyberattacks, such as the costly 2018 Atlanta ransomware attack, which demanded a ransom of $51,000 but resulted in a recovery cost of $17 million. Cyberattacks not only disrupt operations, as seen with the Atlanta incident but also pose risks like the exposure of Snapchat's source code on GitHub. To combat these threats, tools like Cycode are available, offering integration with platforms such as JFrog DevOps to enhance security in software delivery pipelines. Cycode provides comprehensive visibility and advanced detection by correlating event data and user activity, enabling automated remediation via its knowledge graph, and supports various integration types for source control, build container registries, and more. Integrating JFrog Pipelines with Cycode can be achieved through a three-step process involving the addition of JFrog Pipelines from the integration tab, configuring the JFrog Platform URL and Admin Access Token, and linking the JFrog pipeline to Cycode's knowledge graph for ongoing security scanning.

JFrog Artifactory has announced full support for COBOL, emphasizing its significance in modern business applications despite its age. COBOL, known for its operating system-agnostic flexibility, remains vital in financial and business applications, supporting over $3 trillion in daily commerce. JFrog aims to dispel misconceptions about COBOL being outdated by highlighting its continued use on modern mainframes and its influence on modern programming languages. JFrog Artifactory now allows developers to manage COBOL dependencies through local, remote, and virtual repositories, similar to other integrated package types, while also exploring support for other classic languages like PASCAL, FORTRAN, and Smalltalk.

A new zero-day exploit known as "SpringShell" or "Spring4Shell" in the spring-web package poses a threat to internet security, but JFrog assures its platform users that their products, including Artifactory, Xray, Pipelines, and Distribution, remain unaffected by the vulnerability. The JFrog platform offers a comprehensive solution to detect, block, and remediate this vulnerability through tools like Artifactory and Xray, which enable users to conduct thorough scans, trace dependencies, and apply security measures throughout the software development lifecycle. The platform provides users with the ability to quickly identify and address vulnerable packages by updating source code and blocking further usage of compromised builds, ensuring the protection of their software supply chain. Additionally, JFrog has released an open-source tool, scan_spring, to assist non-JFrog users in identifying potential vulnerabilities in their codebases, emphasizing the platform's commitment to maintaining robust security practices and protecting its customers' systems from emerging threats.