June 2022 Summaries

In March, an analysis of the Apache HTTP Server mod_sed filter module revealed a vulnerability, CVE-2022-23943, that could lead to a Denial of Service (DoS) due to buffer size miscalculations, and while the initial fix was implemented, it inadvertently introduced another DoS vulnerability, CVE-2022-30522. This vulnerability, rated as "medium" in severity due to its high impact but limited install base, affects Apache httpd 2.4.53 when large amounts of data are processed by the mod_sed filter, causing memory allocation failures. The issue was resolved in version 2.4.54, and mitigation options include upgrading to the latest version or limiting POST request body sizes to prevent triggering the vulnerability. The mod_sed module allows the manipulation of request and response streams similar to GNU’s sed tool, and the vulnerability can be exploited by sending large data amounts, leading to server process crashes and potential complete DoS. If updating is not possible, applying a patch to the mod_sed filter or configuring the LimitRequestBody directive in Apache's settings is recommended to mitigate the issue.

Software dependencies are crucial artifacts in application development, providing necessary resources and functionality to speed up development, enhance features, and meet organizational requirements. They include a range of elements such as images, icons, libraries, frameworks, and modules, which can be either binary or non-binary. Effective dependency management is essential for all stakeholders in the software development lifecycle, as it impacts performance, security, licensing, and compatibility. Dependencies can vary significantly in size and complexity, from extensive frameworks to simple one-liner modules, and they play different roles in development, runtime, and testing stages. The text emphasizes the importance of understanding the types and levels of dependencies to prioritize updates and manage migration costs effectively. It also highlights tools like Frogbot for scanning binaries and open-source dependencies to improve security and quality, suggesting that developers can integrate such tools into their development environment through available plugins and extensions.

A recent update to Fastjson, version 1.2.83, addresses a significant security vulnerability identified as CVE-2022-25845, which could potentially allow remote code execution by bypassing the "AutoTypeCheck" mechanism. This vulnerability is particularly concerning due to its presence in numerous Java applications that utilize Fastjson versions 1.2.80 or earlier, especially when user-controlled data is parsed without specifying a class. Despite its high CVSS score of 8.1, the exploit's real-world impact is limited as it requires specific conditions, such as the presence of a Java class extending the Throwable class, to be effective. A proof-of-concept demonstrates how such an exploit could theoretically occur, but finding existing, exploitable Java "gadget" classes in real-world applications is rare. To mitigate the risk, upgrading to Fastjson 1.2.83 or enabling "Safe Mode" is recommended. JFrog has confirmed that its DevOps platform is not impacted by this vulnerability, and it offers tools like JFrog Xray for detecting and resolving similar security issues.

Terraform, a widely-used infrastructure-as-code (IaC) tool, can be optimized for efficiency by implementing several key strategies, as demonstrated by JFrog's DevOps and R&D teams. They manage a large-scale infrastructure across multiple regions and cloud providers, and their improvements include aligning infrastructure solely with IaC, creating distinct development and production branches to avoid workspace drift, centralizing modules in a master branch, using an orchestrator to automate workspace management and detect drift, and decoupling data models to prevent interdependencies. Additionally, JFrog has integrated Terraform support into Artifactory, allowing users to manage Terraform files through local, remote, and virtual repositories, transitioning from source control management to binary management. This shift offers various benefits such as enhanced security, immutability, and version control, with Artifactory providing a unified access point for both private and public registries and supporting Terraform remote backends for improved state management.

JFrog Security Research discovered a denial of service (DoS) vulnerability, CVE-2022-29225, in Envoy Proxy, an open-source edge and service proxy server, which can crash the server by exhausting memory through Brotli decompression without output buffer size limits. This vulnerability, allowing attackers to use a Brotli Zip Bomb to degrade performance or crash the Envoy process, was responsibly disclosed and has been fixed in Envoy versions 1.19.5, 1.20.4, 1.21.3, and 1.22.1. While JFrog's DevOps platform is not vulnerable to this issue, users of Envoy who cannot upgrade are advised to disable Brotli decompression as a workaround. JFrog also provides automated security scanning with JFrog Xray to help developers identify vulnerable Envoy configurations.

JFrog has introduced the first Swift binary package repository through JFrog Artifactory, allowing Swift developers to resolve dependencies without relying on enterprise source control systems like Git. This development enhances Swift's package management capabilities with registry-based dependency management, offering a more stable and efficient CI/CD process and addressing issues such as mutable dependencies, enterprise-scale inefficiencies, and challenges in authenticating package origins. Swift, known for its balance of expressibility, performance, and safety, is widely used for iOS and other Apple OS app development, as well as server development. The registry-based system in Swift 5.7.1 provides a reliable alternative to the traditional source control method, improving productivity and security, and enabling smoother integration with other languages like C and Objective-C. JFrog's Artifactory supports local, remote, and virtual repositories to manage Swift packages, promising uninterrupted speed and consistency in builds, with general availability of Swift support set for mid-June.