security-automation

Summary

Dependabot has identified several security vulnerabilities in the 3rd party libraries Pacbot relies on. In most cases, these vulnerabilities can be resolved by upgrading the library to the most current version.

Maintainers, if you're internal to T-Mobile, you should have been seeing these security alerts coming in over the last several weeks. *Please respond to these in a timely ma

Good summary at https://matthewdf10.medium.com/how-to-enable-logging-on-every-aws-service-in-existence-circa-2021-5b9105b87c9 and https://docs.google.com/spreadsheets/d/1DBmCXX1irJvxdewa85p5nSsYEf3tpSKWBbwp700mbzs/edit#gid=0

Amazon Aurora
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-rds-dbcluster.html#cfn-rds-dbcluster-enablecloudwatchlogsexports

AWS AppSync

Add detection for below Redis vulnerability.
https://nvd.nist.gov/vuln/detail/CVE-2022-0543
https://thehackernews.com/2022/03/muhstik-botnet-targeting-redis-servers.html

This might not be trivial as it has to do with the way Redis loads the Lua interpreter on certain Linux distributions. We might be able to find exploitation evidence in redis logs of cache files.

#22 introduced a feature to guess actions that are similar to an existing policy. It currently doesn't support all actions.

Here's things I currently know are missing (comment if you find more):

• KMS: Encrypt, Decrypt, GenerateDataKey, ...
• ECR: BatchDeleteImage, BatchGetImage, ...
• *Deregister*
• *Modify*
• *Remove*
• API Gateway: (DELETE,

🐞 Bug report

Describe the bug

Running install.sh (from the bin folder) tries to install the operator in the version docker.io/securecodebox/operator:v3.1.0-alpha1, which does not exist.

Steps To Reproduce

1. Start with a fresh cluster
2. Run install.sh, install nothing but the operator
3. Observe that the installed operator fails to come up:

% k get pods -n s

I think that you are doing a very necessary system and your idea is cool, but at the moment it has a lot of bugs. From what I noticed, the assets do not understand the ascii characters and the system crashes. In addition, I did not find a description of the API, I would like to integrate your system into TheHive, or rather make it possible to view information about an asset in TheHive. I believe t

Although static declarations are present in the codebase, it is not uniform throughout.
This issue aims to get the entire project typed, so as to allow mypy enforcement in the future.
I believe working on this issue will help anyone trying to familiarize themselves to the project structure (also helps with easy and friendly PRs)

cve_bin_tool/version_signature.py
cve_bin_tool/version_scanner.