4276 articles
4276 ARTICLES
This new CVE-2021-44832 security vulnerability is affecting versions up to 2.17.0, which was previously thought to be fixed. This vulnerability is similar in nature to CVE-2021-4104 which affected the 1.x branch of Log4j.
The truth of the matter is this: open source is never going to be perfect (nothing is!). It’s up to us (as community members) to leave things better than we found them, and help improve the state of open source.
Just days away from 2022, we’d like to reflect and recap on the progress Snyk Infrastructure as Code has achieved over the year on the path to becoming the leading developer-first IaC solution on the market.
As we approach the end of 2021, we’re taking a look back at the big new capabilities in each of Snyk’s products, and in this post we’re going to focus on Snyk Container.
With detailed remediation guidance at every stage of the software development lifecycle (SDLC), Snyk Code revolutionizes static application security testing (SAST).
Let’s take a look at three key areas where Snyk Open Source delivered new capabilities: integrations, ecosystem support, and making fixes easier!
The main challenge with Log4j is understanding your existing infrastructure, and identifying the location of all vulnerable Log4j libraries. Follow Wiz’s recommendations to wrap it all before the Holidays!
Read about the NotLegit vulnerability discovered by the Wiz Research Team, where the Azure App Service exposed hundreds of source code repositories.
Wiz and EY (Ernest & Young) analyzed more than 200 enterprise cloud environments with thousands of cloud accounts. The results were striking: While 93% of all cloud environments are at risk from Log4Shell, on average organizations have patched 45% of their vulnerable cloud resources by Day 10.
Due to the recently discovered Log4Shell vulnerability, and to support the tremendous effort being mounted by the community to address it, we are happy to announce that we are increasing the free test limit in Snyk Open Source!
Automated code reviews use analytical methods to compare new code with defined guidelines. This surfaces vulnerabilities much faster than manual code reviews.
Overnight, it was disclosed by Apache that Log4j version 2.16 is also vulnerable by way of a Denial of Service attack with the impact being a full application crash, the severity for this is classified as High (7.5).