Keynote: Panic in San Francisco: The Critical Vulnerability That Wasn't
summary
October 2022 OpenSSL patch addresses a punycode decoder off by one that copies a four‑byte unsigned value into a buffer, creating a limited buffer overflow that is unlikely to yield remote code execution but can cause denial‑of‑service when filled with dots. Maintainers release a fast patch and later downgrade severity. Shopify locates affected containers using SBOMs across thousands of images and hundreds of thousands of pods, then applies automation like dependabot, targeted detection changes (Falco snap length) and network controls to mitigate impact.
AI-written summary · about
chapters (10)
- 0:00OpenSSL vulnerability panic
- 2:08Vulnerability origin in 2021
- 3:53Buffer overflow risks
- 5:40Initial severity panic
- 7:06Using SBOMs to find systems
- 8:51Costs of incident response
- 10:14Why OpenSSL handled the disclosure well
- 10:56Upgrade rituals for safety
- 12:20Mitigation for unupgradable systems
- 13:22Preparing for next vulnerability
related talks
01h 02mPrompt-Jacking: The Rise of a New Supply Chain Risk
14mKeynote: Keep Calm and Keep Coding: How To Not Panic When Big CVEs Drop
16mKeynote: Securing Shopify's Software Supply Chain
01h 16mClassic Vulnerabilities
13mKeynote: Hacking the OSS Supply Chain
11mKeynote: Securing Open Source
41mPassbolt Keynote
23mConflicts in Vulnerability Management and Patching