Episode 1: DevSecOps Coffee Break Series Add OSS Security & Compliance to Artifactory
Introduction to JFrog Xray and how to reduce vulnerability and license risks of the open source and 3rd party dependencies you rely on.
Security | Threat Detection | Cyberattacks | DevSecOps | Compliance
The Latest Cybersecurity News & Insights From Around The World
JFrog
Episode 2: DevSecOps Coffee Break Series | Creation of Your Software Bill Of Materials SBOM
Learn what an SBOM is, how it will benefit you, which misconceptions exist around it, and why it must be a key element of your SDLC security and compliance process.
Episode 4: DevSecOps Coffee Break Series | 'Shift Left' Security With A Developer Centric Approach
Learn best practices to immediately “shift left” in your Cl/CD process and fix vulnerabilities before they move into the next stage of your SDLC.
Episode 5: DevSecOps Coffee Break Series | If JFrog is Good Enough For The Government, Why Not You
JFrog Artifactory and JFrog Xray achieved Iron Bank Certification - see how they can improve your SDLC security posture with the JFrog Platform.
Episode 3: DevSecOps Coffee Break Series | Securing Your Software Supply Chain
Learn how you can protect your software development lifecycle (SDLC) from supply chain attacks, and ensure the software you deliver to your employees and your customers is safe.
Python Malware Imitates Signed PyPI Traffic in Novel Exfiltration Technique
The JFrog Security research team continuously monitors popular open source software (OSS) repositories with our automated tooling to report vulnerable and malicious packages to repository maintainers. Earlier this year we disclosed several malicious packages targeting developers’ private data that were downloaded approximately 30K times.
TensorFlow Python Code Injection: More eval() Woes
JFrog security research team (formerly Vdoo) has recently disclosed a code injection issue in one of the utilities shipped with Tensorflow, a popular Machine Learning platform that’s widely used in the industry. The issue has been assigned to CVE-2021-41228. This disclosure is hot on the heels of our previous, similar disclosure in Yamale which you can read about in our previous blog post.
Unboxing BusyBox - 14 new vulnerabilities uncovered by Claroty and JFrog
Embedded devices with limited memory and storage resources are likely to leverage a tool such as BusyBox, which is marketed as the Swiss Army Knife of embedded Linux. BusyBox is a software suite of many useful Unix utilities, known as applets, that are packaged as a single executable file. Within BusyBox you can find a full-fledged shell, a DHCP client/server, and small utilities such as cp, ls, grep, and others.
CVE-2021-37136 & CVE-2021-37137 - Denial of Service (DoS) in Netty's Decompressors
The JFrog Security research team has recently disclosed two denial of service issues (CVE-2021-37136, CVE-2021-37137) in Netty, a popular client/server framework which enables quick and easy development of network applications such as protocol servers and clients. In this post we will elaborate on one of the issues – CVE-2021-37136.
New Xray Features Enhance Workflows, Productivity and UX
The recently released JFrog Xray versions 3.31 & 3.32 have brought to the table a raft of new capabilities designed to improve and streamline your workflows, productivity and user experience.