Rud5G

# create alias for cli gerrit requests
alias gerrit='ssh -p 29418 gerrit.yourdomain.com gerrit'

# get tempfile for the ids
tmpfileids=$(tempfile -d /tmp)

# get all commit number ids for the project YOUR_PROJECT_NAME
gerrit query 'status:open project:YOUR_PROJECT_NAME' | egrep '^\ +number' | cut -d' ' -f4- > $tmpfileids

# do mass abandon

Rud5G

'use strict';

/*
 * A flag indicating whether the origin is ready to accept traffic. It's
 * a static value for this example, but you could instead read the value
 * from an S3 bucket with restricted access, a DynamoDB table,
 * or the CloudFront cache.
 */
const originAcceptingTraffic = true;

Rud5G

######################################################################
# /etc/network/interfaces -- configuration file for ifup(8), ifdown(8)
#
# A "#" character in the very first column makes the rest of the line
# be ignored. Blank lines are ignored. Lines may be indented freely.
# A "\" character at the very end of the line indicates the next line
# should be treated as a continuation of the current one.
#
# The "pre-up", "up", "down" and "post-down" options are valid for all 
# interfaces, and may be specified multiple times. All other options

Rud5G

export interface EnvironmentConfig {
  env: {
    account: string;
    region: string;
  };
  stageName: string;
  stateful: {
    bucketName: string;
  };
  stateless: {

Rud5G

...

// add the feature-dev stage with the relevant environment config to the pipeline
// this is the test stage (beta)
const featureDevStage: PipelineStage = new PipelineStage(
  this,
  'FeatureDev',
  {
    ...environments.featureDev,
  }

Rud5G

APSB23-50

https://helpx.adobe.com/security/products/magento/apsb23-50.html

Privilege Escalation

The vulnerability with the highest CVSS score of 8.8 (CVE-2023-38218) states that it is an unauthenticated privilege escalation due to improper input validation.

If we look at the diff we see a number of security related changes. One of those changes is the following in Magento\Customer\Plugin\Webapi\Controller\Rest\ValidateCustomerData::validateInputData:

Rud5G

FROM public.ecr.aws/amazonlinux/amazonlinux:2023

# We tell DNF not to install Recommends and Suggests packages, which are
# weak dependencies in DNF terminology, thus keeping our installed set of
# packages as minimal as possible.
RUN dnf --setopt=install_weak_deps=False install -q -y \
    nodejs \
    npm \
    shadow-utils \
    && \

Rud5G

FROM scratch

ADD 26cb4352778d69ccfacbec9c093f43bb62fee5e385995da7e98dbadc18bf4bbc.tar.xz /
ADD 27e72e63101143b7556236b441759818e78135beac997cfb7abed0fe58bac5d6.tar.xz /
ADD 7cec14968c9186694c5f9573dea2caf9f518bb3fcf6047e9848e6e29c8175cac.tar.xz /
ADD a738322a4c0acd0630828ada97df94b1ed2e76f0d6e21faf68e4f9c039503f32.tar.xz /
ADD e9b8b071d9ac433b7e4955d2b29c3c8f8ae8e030638b9411fb35defe7fca8cb1.tar.xz /
ADD ec3491d15ae5bb145e8640631b026f314ed8182355dcb10978323d076b3121c5.tar.xz /

ENV LANG=en_US.UTF-8

Rud5G

#
# Based on offical image from https://nextjs.org/docs/deployment#docker-image
# See dockerfile: https://github.com/vercel/next.js/blob/canary/examples/with-docker/Dockerfile
#

FROM node:16-alpine AS deps
RUN apk add --no-cache libc6-compat git curl python3 make g++
WORKDIR /opt/app
RUN addgroup --system --gid 1001 app
RUN adduser --system --uid 1001 app -h /opt/app

Rud5G

import { SecretsManager } from "@aws-sdk/client-secrets-manager";

const secretsManager = new SecretsManager({});

const TEST_USER_NAME = "TEST_USER";

const getTestUserPassword = async function () {
  const testUserPassword = await secretsManager.getSecretValue({
    SecretId: process.env.COGNITO_TEST_USER_PASSWORD_SECRETS_MANAGER_ARN,
  });