xz Vulnerability Cover Image

Two Bits on the xz Vulnerability

GitHub Repository xz (Suspended) Source Code https://git.tukaani.org/?p=xz.git Threat Actor Jia Tan (GitHub) CVE Number CVE-2024-3094 (CVSS 10.0) Vulnerability Type Remote Code Execution Attack Category Social Engineering, Supply Chain Attack What does xz module do? XZ Utils is a set of free and open-source data compression utilities that provide high compression ratios and fast decompression....

April 1, 2024 Â· 7 min Â· Kumar Ashwin
Investgating Reported CVEs Cover

Investigating Reported Vulnerabilities: A Closer Look!

In vulnerability scanners or penetration testing reports, you might come across statements like “Service version x.y.z is vulnerable to CVE-YYYY-ABCD." However, it’s essential to delve deeper to confirm the actual vulnerability. Let’s consider a real example: We received a vulnerability report indicating a vulnerability ( CVE-2023-23916 ) in curl v7.74.0 within the Debian 11 environment. The CVE documentation mentions: Affected versions: curl 7.57.0 to and including 7.87.0 At first glance, it appears that v7....

July 30, 2023 Â· 2 min Â· Kumar Ashwin
Linux Command Line References

Linux - Command Line Struggles

Configure Network Using ip Command in Ubuntu Server Temporary Method - $ ip a # to get the interface name after connecting LAN $ sudo ip a add 192.168.1.8/24 dev <network-interface-name> $ ip link set dev <network-interface-name> up $ sudo ip route add default via 192.168.1.1 Permanent Solution - Ref: https://netplan.io/examples/ $ vim /etc/netplan/00-installer-config.yaml network: version: 2 ethernets: enx1027f579a565: dhcp4: false addresses: [192.168.1.10/24] nameservers: addresses: [8.8.8.8,8.8.4.4,192.168.1.1] routes: - to: default via: 192....

July 4, 2022 Â· 2 min Â· Kumar Ashwin