February 2017 Summaries

At Voltos, a company that helps developers manage and share their app's credentials and configuration, they realized that security was not something they could take for granted. They needed a reliable tool to help them identify vulnerabilities in their own security product. After researching, they chose Snyk, a security-focused tool that integrates seamlessly with their workflow. With Snyk, they can automatically check pull requests for vulnerabilities and receive notifications via Slack when new issues are discovered. The tool also allows for adhoc analysis of code without forcing them to follow a specific workflow. By using Snyk, Voltos is able to reinforce security as a valuable aspect of their culture, with every pull request receiving a green check, reminding developers that security is essential at all times.

The Nokogiri library, widely used for parsing and extracting data from XML documents, has a high-severity vulnerability in versions prior to 1.5.4 that allows attackers to execute an XML External Entities (XXE) attack by injecting malicious entities into XML strings. This can lead to significant issues such as denial of service, port scanning, and disclosure of confidential information. The safest way to prevent this attack is to configure the XML parser to not include external DTD's at all. Nokogiri versions greater than 1.5.4 have implemented safeguards to limit exposure, including the DTDLOAD option and the NONET option, which by default are set to false, preventing the vulnerability from being exploited. Users should update to version 1.5.4 or later, double-check their settings, and monitor for updates to ensure protection against this vulnerability.