news
Security Leftovers
-
Trail of Bits ☛ What we learned reviewing one of the first DKLs23 libraries from Silence Laboratories
In October 2023, we audited Silence Laboratories’ DKLs23 threshold signature scheme (TSS) library—one of the first production implementations of this then-novel protocol that uses oblivious transfer (OT) instead of traditional Paillier cryptography. Our review uncovered serious flaws that could enable key destruction attacks, which Silence Laboratories promptly fixed.
-
Security Week ☛ Critical Vulnerability Patched in SAP NetWeaver
SAP has fixed a critical NetWeaver vulnerability allowing attackers to bypass authorization checks and escalate their privileges.
-
Security Week ☛ Five Zero-Days, 15 Misconfigurations Found in Salesfarce Industry Cloud
Security researchers uncover critical flaws and widespread misconfigurations in Salesfarce’s industry-specific CRM solutions.
-
LWN ☛ Safety certification for open-source systems
This year's Linaro Connect in Lisbon, Portugal featured a number of talks about the use of open-source components in safety-critical systems. Kate Stewart gave a keynote on the topic on the first day of the conference. In it, she highlighted several projects that have been working to pursue safety certification and spoke about the importance of being able to trace software's origins to safety. In a talk on the second day, Roberto Bagnara shared his experience with working on one of those projects, the Xen hypervisor, to conform to a formal set of rules for safety-critical code.