Некоммерческий консорциум The Linux Foundation объявил о формировании сразу двух новых фондов: GraphQL Foundation и Ceph Foundation. Далее — подробнее о каждом из них. Читать дальше →
A flaw was found in the ceph-ansible playbook where it contained hardcoded passwords that were being used as default passwords while deploying Ceph services. Any authenticated attacker can abuse this flaw to brute-force Ceph deployments, and gain administrator access to Ceph clusters via the Ceph dashboard to initiate read, write, and delete Ceph clusters and also modify Ceph cluster configurations. Versions before ceph-ansible 6.0.0alpha1 are affected.
GraphQL Playground is a GraphQL IDE for development of graphQL focused applications. All versions of graphql-playground-react older than graphql-playground-react@1.7.28 are vulnerable to compromised HTTP schema introspection responses or schema prop values with malicious GraphQL type names, exposing a dynamic XSS attack surface that can allow code injection on operation autocomplete. In order for the attack to take place, the user must load a malicious schema in graphql-playground. There are several ways…
В нашем блоге мы уже рассказывали о двух «свежих» фондах Linux Foundation — GraphQL и Ceph. В прошлом месяце консорциум учредил еще один проект — Edge, задачей которого станет развитие облачных и периферийных вычислений. Рассказываем, кто уже стал его членом. Читать дальше →