Podcasts Technology Day[0] [bounty] Got UNIX Sockets and Some Filter Bypasses?

[bounty] Got UNIX Sockets and Some Filter Bypasses?

Published: Oct. 11, 2022, 8 p.m.

No actual bounties this week, but we start off with a discussion on semgrep vs codeql, then get into some cool issues that you can start testing for.

\n


\n

Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/157.html

\n


\n

[00:00:00] Introduction

\n

[00:00:39] Comparing Semgrep and CodeQL

\n

[00:14:27] A Deep Dive of CVE-2022\u201333987 (Got allows a redirect to a UNIX socket)

\n

[00:20:18] Melting the DNS Iceberg: Taking over your infrastructure Kaminsky style

\n

[00:28:23] [OpenJDK] Weak Parsing Logic in java.net.InetAddress and Related Classes

\n

[00:34:22] RCE via Phar Deserialisation [CVE-2022-41343]

\n