From the Frog's mouth

Python Malware Imitates Signed PyPI Traffic in Novel Exfiltration Technique

November 18, 2021 Andrey Polkovnychenko and Shachar Menashe | 10 min read

The JFrog Security research team continuously monitors popular open source software (OSS) repositories with our automated tooling to report vulnerable and malicious packages to repository maintainers. Earlier this year we disclosed several malicious packages targeting developers’ private data that were downloaded approximately 30K times. Today, we will share details about 11 new malware packages that…

Embrace your Updates

November 18, 2021 Fred Simon, Co-Founder and Chief Data Scientist, JFrog | 4 min read

As developers, we’re passionate about creating and delivering high-quality software to our end-users and customers. Simply knowing that our software was shipped, deployed, and is being used is a great achievement. And it looks like we did a good job. Everything around us in our lives depends on high-quality software. Software needs to run for…

TensorFlow Python Code Injection: More eval() Woes

November 16, 2021 Omer Kaspi and Shachar Menashe | 2 min read

Background JFrog security research team (formerly Vdoo) has recently disclosed a code injection issue in one of the utilities shipped with TensorFlow, a popular Machine Learning platform that's widely used in the industry. The issue has been assigned to CVE-2021-41228. Read more about our previous, similar disclosure in Yamale in our previous blog post. The…

Unboxing BusyBox – 14 new vulnerabilities uncovered by Claroty and JFrog

November 9, 2021 Vera Mens, Uri Katz, Tal Keren, Sharon Brizinov from Claroty Research
Shachar Menashe from JFrog
| 15 min read

Background Embedded devices with limited memory and storage resources are likely to leverage a tool such as BusyBox, which is marketed as the Swiss Army Knife of embedded Linux. BusyBox is a software suite of many useful Unix utilities, known as applets, that are packaged as a single executable file. Within BusyBox you can find…

Announcing the JFrog Slack App for Artifactory and Xray Cloud

November 16, 2021 Deep Datta | 4 min read

Imagine a world where every team member could directly contribute to software together. We’re living in that world now. With more than 10 million daily active users, Slack is one of the most ‘lived in’ collaboration tools used by software development teams around the world. With this in mind, JFrog is excited to announce that…

Deploy Iron Bank-Approved Artifactory/Xray on AWS GovCloud and RKE2

October 27, 2021 Sudhindra Rao, Strategic Solutions Architect, JFrog | 6 min read

With Artifactory and Xray now included in the U.S. Department of Defense’s Iron Bank container repository, we’re eager to help you benefit from this accreditation. Today, we’ll explain how to deploy these hardened JFrog images on AWS GovCloud using Rancher Kubernetes Edition (RKE2.) Specifically, we’ll describe the installation and configuration of the Iron Bank-accredited Artifactory…

CVE-2021-37136 & CVE-2021-37137 – Denial of Service (DoS) in Netty’s Decompressors

October 26, 2021 Ori Hollander | 3 min read

Background The JFrog Security research team has recently disclosed two denial of service issues (CVE-2021-37136, CVE-2021-37137) in Netty, a popular client/server framework which enables quick and easy development of network applications such as protocol servers and clients. In this post we will elaborate on one of the issues - CVE-2021-37136. Who is actually impacted? Netty…

New Xray Features Enhance Workflows, Productivity and UX

October 21, 2021 Paul Garden, Product Marketing Manager | 5 min read

The recently released JFrog Xray versions 3.31 & 3.32 have brought to the table a raft of new capabilities designed to improve and streamline your workflows, productivity and user experience. The new features, detailed below, solidify Xray as the optimum universal software composition analysis (SCA) solution for JFrog Artifactory that's trusted by developers and DevSecOps…

CVE-2020-27304 – RCE via Directory Traversal in CivetWeb HTTP server

October 19, 2021 Denys Vozniuk and Shachar Menashe | 6 min read

Background JFrog has recently disclosed a directory traversal issue in CivetWeb, a very popular embeddable web server/library that can either be used as a standalone web server or included as a library to add web server functionality to an existing application. The issue has been assigned to CVE-2020-27304. This directory traversal issue is highly exploitable…

Welcome to the JFrog Blog

Latest:

With AWS EKS Anywhere, DevOps with Artifactory Can Be Everywhere