Forwarded from MiaoTony's Box (MiaoTony 🐱)
#今天又看了啥 #telegram #security #CVE #XSS
Telegram Web app XSS/Session Hijacking 1-click [CVE-2024–33905]
Attack surface: Telegram Mini Apps
“Telegram Mini Apps are essentially web applications that you can run directly within the Telegram messenger interface. Mini Apps support seamless authorization, integrated crypto and fiat payments (via Google Pay and Apple Pay), tailored push notifications, and more.”
This attack surface also affects web3 users because it handles crypto payments through the TON Blockchain.
Telegram fixed the flaw on March 11th, 2024.
Vulnerable version: Telegram WebK 2.0.0 (486) and below
Fixed version: Telegram WebK 2.0.0 (488)
https://medium.com/@pedbap/telegram-web-app-xss-session-hijacking-1-click-95acccdc8d90
Telegram Web app XSS/Session Hijacking 1-click [CVE-2024–33905]
Attack surface: Telegram Mini Apps
“Telegram Mini Apps are essentially web applications that you can run directly within the Telegram messenger interface. Mini Apps support seamless authorization, integrated crypto and fiat payments (via Google Pay and Apple Pay), tailored push notifications, and more.”
This attack surface also affects web3 users because it handles crypto payments through the TON Blockchain.
Telegram fixed the flaw on March 11th, 2024.
Vulnerable version: Telegram WebK 2.0.0 (486) and below
Fixed version: Telegram WebK 2.0.0 (488)
https://medium.com/@pedbap/telegram-web-app-xss-session-hijacking-1-click-95acccdc8d90
Medium
Telegram Web app XSS/Session Hijacking 1-click
This is the technical write up of a severe vulnerability I reported to Telegram’s Bug Bounty program on March 9th, 2024.
Telegram fixed…
Telegram fixed…
GNU nano 8.0 released
Rust 1.78.0 released
The 6.9-rc7 kernel prepatch is out for testing.
"run0" as a sudo replacement (part of the upcoming systemd 256 release)
Rust 1.78.0 released
The 6.9-rc7 kernel prepatch is out for testing.
"run0" as a sudo replacement (part of the upcoming systemd 256 release)
咕 Billchen 咕 🐱 抹茶芭菲批发中心
GNU nano 8.0 released Rust 1.78.0 released The 6.9-rc7 kernel prepatch is out for testing. "run0" as a sudo replacement (part of the upcoming systemd 256 release)
Save Nix Together
Eelco Dolstra’s leadership is corrosive to the Nix project
https://save-nix-together.org/
https://really-save-nix-together.org/
https://determinate.systems/posts/on-community-in-nix/
Eelco Dolstra’s leadership is corrosive to the Nix project
https://save-nix-together.org/
https://really-save-nix-together.org/
https://determinate.systems/posts/on-community-in-nix/
GLib CVE-2024-34397: GDBus signal subscriptions for well-known names are vulnerable to unicast spoofing
Vulnerable versions:
GLib 2.80.x before 2.80.1
all versions before 2.78.5
https://gitlab.gnome.org/GNOME/glib/-/issues/3268
Vulnerable versions:
GLib 2.80.x before 2.80.1
all versions before 2.78.5
https://gitlab.gnome.org/GNOME/glib/-/issues/3268
GitLab
CVE-2024-34397: GDBus signal subscriptions for well-known names are vulnerable to unicast spoofing (#3268) · Issues · GNOME / GLib…
Vulnerability summary Alicia Boya García discovered a security issue in GLib's GDBusConnection. When subscribing to a D-Bus signal using a...
[security] Go 1.22.3 and Go 1.21.10 are released
CVE-2024-24787: On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a "#cgo LDFLAGS" directive.
CVE-2024-24788: A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.
https://groups.google.com/g/golang-announce/c/wkkO4P9stm0
CVE-2024-24787: On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a "#cgo LDFLAGS" directive.
CVE-2024-24788: A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.
https://groups.google.com/g/golang-announce/c/wkkO4P9stm0
咕 Billchen 咕 🐱 抹茶芭菲批发中心
https://docs.python.org/3.13/whatsnew/3.13.html#what-s-new-in-python-3-13
As documented in the PEP 719, the first beta of Python 3.13 was released on May 7. (No new features beyond this point.)
咕 Billchen 咕 🐱 抹茶芭菲批发中心
https://docs.python.org/3.13/whatsnew/3.13.html#what-s-new-in-python-3-13
PEP 703: CPython 3.13 has experimental support for running with the global interpreter lock disabled when built with --disable-gil.
https://peps.python.org/pep-0703/
ref https://www.tg-me.com/outvivid/4469
https://peps.python.org/pep-0703/
ref https://www.tg-me.com/outvivid/4469
Python Enhancement Proposals (PEPs)
PEP 703 – Making the Global Interpreter Lock Optional in CPython | peps.python.org
CPython’s global interpreter lock (“GIL”) prevents multiple threads from executing Python code at the same time. The GIL is an obstacle to using multi-core CPUs from Python efficiently. This PEP proposes adding a build configuration (--disable-gil) to...
🎉7
Forwarded from Solidot
G5 地磁风暴来袭
2024-05-11 10:03 by 奇岛
直径为 17 倍于地球的太阳黑子区域 AR3664 向地球方向喷射了 6 个日冕物质抛射 (CME)，首个 CME 于 5 月 10 日 1645 UT 抵达并影响地球，产生极端强度的电磁风暴。地磁风暴强度范围从 G1 到 G5，其中 G5 为最高等级。随着后续 CME 的到来，地磁风暴将持续到周日。这是自 2003 年 10 月以来首次观测到 G5 地磁风暴，太阳活动目前处于活跃期。G5 地磁风暴将会在北方产生壮观的极光，可能会影响近地轨道和地球表面的基础设施，扰乱通信、电网、导航、无线电和卫星运行。
https://www.swpc.noaa.gov/news/g5-conditions-observed
https://spaceweather.com/
#地球
2024-05-11 10:03 by 奇岛
直径为 17 倍于地球的太阳黑子区域 AR3664 向地球方向喷射了 6 个日冕物质抛射 (CME)，首个 CME 于 5 月 10 日 1645 UT 抵达并影响地球，产生极端强度的电磁风暴。地磁风暴强度范围从 G1 到 G5，其中 G5 为最高等级。随着后续 CME 的到来，地磁风暴将持续到周日。这是自 2003 年 10 月以来首次观测到 G5 地磁风暴，太阳活动目前处于活跃期。G5 地磁风暴将会在北方产生壮观的极光，可能会影响近地轨道和地球表面的基础设施，扰乱通信、电网、导航、无线电和卫星运行。
https://www.swpc.noaa.gov/news/g5-conditions-observed
https://spaceweather.com/
#地球