Xray Archives

Wolves or Sheep: How Xray Avoids False Positives in Vulnerabilities Scans

April 20, 2022 Paul Garden | 7 min read

You probably know the story of “the boy who cried ‘Wolf!’” In the ancient fable, villagers tire of a shepherd’s false alarms, and stop paying attention to them. That’s a lesson for software security teams, not just schoolchildren. Raising concerns about threats that turn out to be flimsy or false erodes the trust that binds…

CVE-2022-24675 – Stack overflow (exhaustion) in Go’s PEM decoder

April 18, 2022 David Cohen | 4 min read

A few days ago it was reported that the new Go versions 1.18.1 and 1.17.9 contain fixes for a stack overflow vulnerability in the encoding/pem builtin package, in the Decode function. Given the high popularity of Go among our customers and in the industry at large, this update led us to investigate the vulnerability in…

Secure your git repository with Frogbot the git bot

April 7, 2022 Eyal Ben Moshe | 3 min read

Introducing the newest member of the JFrog ecosystem team - Frogbot. This new git bot tool works for you by protecting your git projects, as they are being developed, from security vulnerabilities. Register for my talk “Bots to Protect your Source Code” swampUP 2022 How does Frogbot work? The concept is simple. Frogbot scans every…

Your SpringShell (Spring4Shell) Remediation Cookbook Using the JFrog Platform

April 1, 2022 Asaf Cohen and Boaz Blankman, JFrog Security Research Team | 11 min read

A new zero-day exploit in the spring-web package called "SpringShell" (nicknamed “Spring4Shell”) was just leaked and is threatening the internet and the community. The JFrog security research team is investigating the exploit and continuously updating our blog post with technical details on the SpringShell (Spring4Shell) vulnerability. In this technical blog post, we explain how you…

Large-scale npm attack targets Azure developers with malicious packages

March 23, 2022 Andrey Polkovnychenko and Shachar Menashe | 8 min read

The JFrog Security research team continuously monitors popular open source software (OSS) repositories with our automated tooling to avert potential software supply chain security threats, and reports any vulnerabilities or malicious packages discovered to repository maintainers and the wider community. Two days ago, several of our automated analyzers started alerting on a set of packages…

Diving into CVE-2022-23943 – a new Apache memory corruption vulnerability

March 17, 2022 Brian Moussalli | 7 min read

A few days ago it was reported that the new Apache version 2.4.53 contains fixes for several bugs which exposed the users of the well known HTTP server to attacks: CVE-2022-22719 relates to a bug in the mod_lua modules which may lead to Denial of Service after reading from a random memory Area, CVE-2022-22720 exposes…

Shift Left for DevSecOps Success

March 10, 2022 Bill Manning, Solutions Architect / Engineering Manager, JFrog | 7 min read

Not long ago, developers built applications with little awareness about security and compliance. Checking for vulnerabilities, misconfigurations and policy violations wasn’t their job. After creating a fully-functional application, they’d throw it over the proverbial fence, and a security team would evaluate it at some point – or maybe never. Those days are gone – due…

DirtyPipe (CVE-2022-0847) – the new DirtyCoW?

March 9, 2022 Itay Vaknin | 6 min read

A few days ago, security researcher Max Kellermann published a vulnerability named DirtyPipe which was designated as CVE-2022-0847. This vulnerability affects the Linux kernel and if exploited, can allow a local attacker to gain root privileges. The vulnerability gained extensive media follow-up, since it affects all Linux-based systems with a 5.8 or later kernel, without…

7 RCE and DoS vulnerabilities Found in ClickHouse DBMS

March 15, 2022 Uriya Yavnieli and Or Peles | 10 min read

The JFrog Security research team constantly monitors open-source projects to find new vulnerabilities or malicious packages and share them with the wider community to help improve their overall security posture. As part of this effort, the team recently discovered seven new security vulnerabilities in ClickHouse, a widely used open-source Database Management System (DBMS) dedicated to…

Xray: New Year, New Security Features

February 16, 2022 Paul Garden, JFrog Product Marketing Manager | 5 min read

As part of our ongoing efforts to offer you the most comprehensive and advanced SDLC protection capabilities, JFrog continues to boost the capabilities of our JFrog Xray security and compliance product. In this blog, we offer an overview of recent Xray improvements, all aimed at helping you fortify your software, reduce risk, scale security, streamline…

Welcome to the JFrog Blog

Latest from Xray :

GitHub and JFrog Partner To Unify Code and Binaries for DevSecOps