The social news site admitted that attackers had “gained access to some internal documents, code, and some internal business systems” while stating that it reckoned “Reddit user passwords and accounts are safe”. Thursday also brought news that a sysadmin on Reddit had fallen victim to a phishing attack. The flaw meant that sophisticated attackers might be able to either read system memory or cause a denial of service on affected systems. On Thursday, developers of the OpenSSL project released patches covering a variety of vulnerabilities in the encryption library, including a high impact flaw (tracked as CVE-2023-0286). Want the latest web security news direct to your inbox? Sign up to our new newsletter – Daily Swig Deserialized The US Cybersecurity and Infrastructure Security Agency (CISA) is pushing plans to require technology manufacturers to make their products secure by design.ĬISA director Jen Easterly and executive assistant director Eric Goldstein outlined the proposals in an essay published by Foreign Affairs magazine. Master keys for these vaults were not exposed, limiting the scope for harm, but the affair was nonetheless troubling. Issues in password managers have been a particular focus for security researchers since a mishandled security incident involving LastPass last year that eventually prompted the vendor to admit encrypted password vaults had leaked. The vulnerability – whose seriousness is disputed – is being tracked as CVE-2023-24055.Īs Bleeping Computer reports, KeePass maintains the issue only comes into play in cases where an attacker already has control of a compromised account – in which case it’s ‘game over’ already.
Security researchers warned that it might be possible to set up a trigger that exports everything from the KeePass database in cleartext, before syphoning off secret data. KeePass has become the latest password manager utility obliged to defend its reputation following the discovery of an alleged vulnerability. Your fortnightly rundown of AppSec vulnerabilities, new hacking techniques, and other cybersecurity news
0 kommentar(er)
