CVE-2022-3602
betterscan-ce
| CVE-2022-3602 | betterscan-ce | |
|---|---|---|
| 3 | 34 | |
| 167 | 694 | |
| - | - | |
| 10.0 | 7.3 | |
| over 1 year ago | about 1 month ago | |
| Python | Python | |
| - | GNU General Public License v3.0 or later |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
CVE-2022-3602
-
OpenSSL Releases Patch for 2 New High-Severity Vulnerabilities
PoC w/proper technical details: https://github.com/colmmacc/CVE-2022-3602 (no rickroll)
-
OpenSSL 3.0.7 Published
Colm MacCárthaigh has a nice writeup on CVE−2022-3602 including steps to reproduce: https://github.com/colmmacc/CVE-2022-3602
- oggi 2022-11-01 verrà rilasciata una vulnerabilità di livello CRITICAL su OpenSSL 3.0.x
betterscan-ce
-
Cloud and Code Security - betterscan.io
More on the website: www.betterscan.io
-
Do you SLSA or SBOM in your SDLC?
Maybe you will find https://github.com/marcinguy/betterscan-ce useful (scans SBOMs and Dependencies, apart from Code and IaC).
-
SBOM and dependencies check tool and vulnerabilities database from Google
P.S I also added it to my Security Automation/Orchestration project, it was missing there: https://github.com/marcinguy/betterscan-ce Hope it helps somebody.
-
Nosey Parker: a new scanner to find misplaced secrets in textual data and Git history
Congrats on release. Feel free to check out https://github.com/marcinguy/betterscan-ce It is not that fast, but detects 166+ secret types (modified trufflehog3) and also bugs and vulnerabilities in Code and Cloud setups.
-
OpenSSL 3.0.7 Published
If you want to scan binary to see if this uses vulnerable version, use this YARA rule: https://github.com/marcinguy/betterscan-ce/blob/master/analy...
Courtesy of Akamai.
If you don't know YARA tool, you can run this command in the folder where your binary is (it will install everything needed):
sh <(curl https://dl.betterscan.io/cli.sh)
Hope that helps somebody
-
Text4shell CVE-2022-42889 scan
More: https://github.com/marcinguy/betterscan-ce
- Asking for feedback about my business website
- PMD Apex Code Scanner with integration with CLI output (HTML, JSON, Terminal) or Platform
- Open Source (with Professional paid version) Apex Scanning Tool for Salesforce for Security, Quality and Best practices using PMD with many other checks (incl. secrets)
- Checkov + Kubescape + Code checks unified in one interface/UI or output
What are some alternatives?
OpenSSL-2022 - Operational information regarding CVE-2022-3602 and CVE-2022-3786, two vulnerabilities in OpenSSL 3
awesome-guidelines - A curated list of high quality coding style conventions and standards.
rustls-ffi - Use Rustls from any language
osv-scanner - Vulnerability scanner written in Go which uses the data provided by https://osv.dev
nixpkgs - Nix Packages collection & NixOS
noseyparker - Nosey Parker is a command-line program that finds secrets and sensitive information in textual data and Git history.
OpenSSL - TLS/SSL and crypto library
ThreatPlaybook - A unified DevSecOps Framework that allows you to go from iterative, collaborative Threat Modeling to Application Security Test Orchestration
testssl.sh - Testing TLS/SSL encryption anywhere on any port
osv.dev - Open source vulnerability DB and triage service.
trufflehog - Find and verify secrets
leaky-repo - Benchmarking repo for secrets scanning