Security Leftovers
-
Security updates for Friday [LWN.net]
Security updates have been issued by Fedora (cacti, cacti-spine, mbedtls, postgresql-jdbc, and rust), Oracle (.NET 6.0, dbus, expat, grub2, kernel, kernel-container, libtasn1, libtiff, sqlite, and usbguard), Red Hat (rh-postgresql10-postgresql), SUSE (php7), and Ubuntu (heimdal, linux, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15, linux-gcp, linux-gcp-5.15, linux-hwe-5.15, linux-ibm, linux-kvm, linux-oracle, linux-raspi,, linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-5.4, linux-hwe, linux-ibm, linux-kvm, linux-oracle, linux-oracle-5.4,, linux, linux-aws, linux-kvm, linux-lts-xenial, and vim).
-
Use Any SOP Binary With SOP-Java and External-SOP - vanitasvitae’s blog
The Stateless OpenPGP Protocol specification describes a shared, standardized command line interface for OpenPGP applications. There is a bunch of such binaries available already, among them PGPainless’ pgpainless-cli, Sequoia-PGP’s sqop, as well as ProtonMails gosop. These tools make it easy to use OpenPGP from the command line, as well as from within bash scripts (all of those are available in Debian testing or in the main repo) and the standardized interface allows users to switch from one backend to the other without the need to rewrite their scripts.
The Java library sop-java provides a set of interface definitions that define a java API that closely mimics the command line interface. These interfaces can be implemented by anyone, such that developers could create a drop-in for sop-java using the OpenPGP library of their choice. One such backend is pgpainless-sop, which implements sop-java using the PGPainless library.
-
Kinsing Malware Targets Kubernetes [Ed: Microsoft facilitates the NSA with back doors and isn't patching actively-exploited holes. Now it's trying to deflect and Steven J. Vaughan-Nichols helps Microsoft.]
-
Attackers deploy sophisticated Linux implant on Fortinet network security devices | CSO Online [Ed: Media tries hard to associate this with "Linux" while bagging money from Microsoft.]
Fortinet rated the vulnerability 9.3 (Critical) on the CVSS scale and released updates to major variants of FortiOS, FortiOS-6K7K and FortiProxy, the company's secure web gateway product. FortiOS runs on the company's FortiGate network security firewalls and other appliances.