Example #1: March 28, 21 - Sick.codes has the information and chronology of a disturbing vulnerability found in some software.
If one looks at the details of this vulnerability and how it was found (by accident) and what was found was that some software (that includes netmask) it is included in the npm package in Unix/Linux systems or other operating Systems.
A CVE has been issued CVE-2021-28918 . Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.
Does the above explanation make sense to non-systems or programmer people?
Interesting to note that
So what does this vulnerability mean to your systems and devices?
It means that there may be software that incidentally has been downloaded 278,000 times which has this arcane problem. So we have to find out whether it will affect and then upgrade. It may not affect your program, it depends (as the sick.codes post explains.
How do we fix this? We have to have a system of upgrading/patching and testing your devices to find out if your systems are vulnerable.
Contact Us to discuss or buy my ebook for now soon paper copy coming.
