June 2020 Summaries

The current state of package manager support for two-factor authentication (2FA) is limited, with only a few platforms offering robust security measures. However, another approach to enhance security, called package signing, has gained traction across various ecosystems. This involves using cryptographic signatures to verify the authenticity and integrity of packages during download. Package signing offers an end-to-end verification that a package was uploaded by its maintainer, making it a valuable tool for protecting against supply-chain attacks and ensuring the trustworthiness of open-source packages. Several programming languages' package managers support package signing, including Nuget, Maven, Gradle, Rubygems, npm, Pypi, and others, with varying degrees of implementation and adoption. While some platforms are still in the process of implementing or exploring package signing, it has already shown promise in enhancing security and trust in open-source software development.

Apache Kylin is an open-source, distributed Analytical Data Warehouse for Big Data written in Java, originally developed by eBay and used by global enterprises to analyze large datasets. A SQL injection vulnerability (CVE-2020-1937) was discovered in Apache Kylin, which led to the discovery of another severe vulnerability (CVE-2020-1956) that allows malicious users to execute arbitrary OS commands and take over the host system. The vulnerability affects all releases up to version 2.6.5 and 3.0.1, and can be exploited by authenticated users with MANAGEMENT or ADMIN permissions during a Cube migration via the Kylin web interface. To mitigate this vulnerability, input validation is necessary, and an alternative patch using an allowlist approach has been implemented to sanitize user-controlled parameters against breaking out of the current command and invoking new commands. The patch was released in Apache Kylin 3.0.2 and 2.6.6, and users are encouraged to upgrade or disable Cube migrations to prevent exploitation.