Netflix/security-bulletins

Stars
734
Rank 61,748 (Top 2 %)
Language
Created almost 10 years ago
Updated almost 2 years ago

Netflix/security-bulletins

Netflix

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Security Bulletins that relate to Netflix Open Source

Security Bulletins

Below are notifications for security and privacy events within Netflix Open Source applications.

Date	Type	Subject
February 28, 2023	Low	Insecure random generation in Lemur
March 30, 2022	Critical	Format String Vulnerability in ConsoleMe
March 23, 2021	Important	Local Information Disclosure in Priam
March 23, 2021	Important	Local Information Disclosure in Hollow
March 10, 2021	Important	Critical Vulnerability Exposing Private Keys in Lemur
December 08, 2020	Important	SpEL Template injection on Netflix Spinnaker
November 6, 2020	Important	Multiple Access Control Issues in Dispatch
November 6, 2020	Important	Multiple XSS Vulnerabilities in Dispatch
August 27, 2020	Important	Authenticated Server-Side Request Forgery in Orca Spinnaker
March 05, 2020	Important	Server-Side Template Injection in Netflix Titus
February 24, 2020	Important	Server-Side Template Injection in Netflix Conductor
June 20, 2019	Informational	Dial Reference code implementation has Denial of Service
January 10, 2018	Important	Unauthenticated Server-Side Request Forgery in Hystrix-Dashboard
April 14, 2017	Important	Spinnaker Orca RCE and arbitrary file and URL access
August 31, 2016	Important	zuul.filter.admin.enabled Defaults to True
June 6, 2016	Important	Heap Overflow in Dynomite YAML Configuration Parser
February 22, 2015	Important	External Entity Injection 'XXE' in Recipes-rss Open-Source Application

Below are notifications for security vulnerabilities in third-party software.

Date	Type	Subject
August 13, 2019	Important	HTTP/2 Denial of Service Advisory
June 17, 2019	Important	Linux and FreeBSD Kernel: Multiple TCP-based remote denial of service vulnerabilities

Unfortunately we are not able to address software support issues in this repository. Please contact the upstream project instead.

Hystrix

Hystrix is a latency and fault tolerance library designed to isolate points of access to remote systems, services and 3rd party libraries, stop cascading failure and enable resilience in complex distributed systems where failure is inevitable.

chaosmonkey

Chaos Monkey is a resiliency tool that helps applications tolerate random instance failures.

zuul

Zuul is a gateway service that provides dynamic routing, monitoring, resiliency, security, and more.

conductor

Conductor is a microservices orchestration engine.

eureka

AWS Service registry for resilient mid-tier load balancing and failover.

falcor

A JavaScript library for efficient data fetching

pollyjs

Record, Replay, and Stub HTTP Interactions.

metaflow

🚀 Build and manage real-life ML, AI, and data science projects with ease!

SimianArmy

Tools for keeping your cloud operating in top form. Chaos Monkey is a resiliency tool that helps applications tolerate random instance failures.

fast_jsonapi

No Longer Maintained - A lightning fast JSON:API serializer for Ruby Objects.

vmaf

Perceptual video quality assessment based on multi-method fusion.

dispatch

All of the ad-hoc things you're doing to manage incidents today, done for you, and much more!

ribbon

Ribbon is a Inter Process Communication (remote procedure calls) library with built in software load balancers. The primary usage model involves REST calls with various serialization scheme support.

security_monkey

Security Monkey monitors AWS, GCP, OpenStack, and GitHub orgs for assets and their changes over time.

dynomite

A generic dynamo implementation for different k-v storage engines

vizceral

WebGL visualization for displaying animated traffic graphs

vector

Vector is an on-host performance monitoring framework which exposes hand picked high resolution metrics to every engineer’s browser.

atlas

In-memory dimensional time series database.

concurrency-limits

consoleme

A Central Control Plane for AWS Permissions and Access

dgs-framework

GraphQL for Java with Spring Boot made easy.

flamescope

FlameScope is a visualization tool for exploring different time ranges as Flame Graphs.

bless

Repository for BLESS, an SSH Certificate Authority that runs as a AWS Lambda function

archaius

Library for configuration management API

asgard

[Asgard is deprecated at Netflix. We use Spinnaker ( www.spinnaker.io ).] Web interface for application deployments and cloud management in Amazon Web Services (AWS). Binary download: http://github.com/Netflix/asgard/releases

curator

ZooKeeper client wrapper and rich ZooKeeper framework

EVCache

A distributed in-memory data store for the cloud

titus

lemur

Repository for the Lemur Certificate Manager

bpftop

bpftop provides a dynamic real-time view of running eBPF programs. It displays the average runtime, events per second, and estimated total CPU % for each program.

genie

Distributed Big Data Orchestration Service

metacat

netflix.github.com

servo

Netflix Application Monitoring Library

mantis

A platform that makes it easy for developers to build realtime, cost-effective, operations-focused applications

vectorflow

hubcommander

A Slack bot for GitHub organization management -- and other things too

rend

A memcached proxy that manages data chunking and L1 / L2 caches

hollow

Hollow is a java library and toolset for disseminating in-memory datasets from a single producer to many consumers for high performance read-only access.

repokid

AWS Least Privilege for Distributed, High-Velocity Deployment

astyanax

Cassandra Java Client

Priam

Co-Process for backup/recovery, Token Management, and Centralized Configuration management for Cassandra.

aminator

A tool for creating EBS AMIs. This tool currently works for CentOS/RedHat Linux images and is intended to run on an EC2 instance.

Turbine

SSE Stream Aggregator

governator

Governator is a library of extensions and utilities that enhance Google Guice to provide: classpath scanning and automatic binding, lifecycle management, configuration to field mapping, field validation and parallelized object warmup.

Fido

suro

Netflix's distributed Data Pipeline

spectator

Client library for collecting metrics.

Fenzo

Extensible Scheduler for Mesos Frameworks

msl

Message Security Layer

unleash

Professionally publish your JavaScript modules in one keystroke

denominator

Portably control DNS clouds using java or bash

blitz4j

Logging framework for fast asynchronous logging

edda

AWS API Read Cache

PigPen

Map-Reduce for Clojure

netflix-graph

Compact in-memory representation of directed graph data

go-env

a golang library to manage environment variables

karyon

The nucleus or the base container for Applications and Services built using the NetflixOSS ecosystem

Prana

A sidecar for your NetflixOSS based services.

iceberg

Iceberg is a table format for large, slow-moving tabular data

Lipstick

Pig Visualization framework

Surus

aws-autoscaling

Tools and Documentation about using Auto Scaling

go-expect

an expect-like golang library to automate control of terminal or console based programs.

nf-data-explorer

The Data Explorer gives you fast, safe access to data stored in Cassandra, Dynomite, and Redis.

Workflowable

osstracker

Github organization OSS metrics collector and metrics dashboard

vizceral-example

Example Vizceral app

ndbench

Netflix Data Store Benchmark

Raigad

Co-Process for backup/recovery, Auto Deployments and Centralized Configuration management for ElasticSearch

recipes-rss

RSS Reader Recipes that uses several of the Netflix OSS components

aegisthus

A Bulk Data Pipeline out of Cassandra

weep

The ConsoleMe CLI utility

metaflow-ui

🎨 UI for monitoring your Metaflow executions!

titus-control-plane

Titus is the Netflix Container Management Platform that manages containers and provides integrations to the infrastructure ecosystem.

dyno-queues

Dyno Queues is a recipe that provides task queues utilizing Dynomite.

image_compression_comparison

Image Compression Comparison Framework

falcor-express-demo

Demonstration Falcor end point for a Netflix-style Application using express

gradle-template

ember-nf-graph

Composable graphing component library for EmberJS.

falcor-router-demo

A demonstration of how to build a Router for a Netflix-like application

titus-executor

Titus Executor is the container runtime/executor implementation for Titus

photon

Photon is a Java implementation of the Interoperable Master Format (IMF) standard. IMF is a SMPTE standard whose core constraints are defined in the specification st2067-2:2013

dial-reference

s3mper

s3mper - Consistent Listing for S3

ReactiveLab

Experiments and prototypes with reactive application design.

inviso

NfWebCrypto

Web Cryptography API Polyfill

staash

A language-agnostic as well as storage-agnostic web interface for storing data into persistent storage systems, the metadata layer abstracts a lot of storage details and the pattern automation APIs take care of automating common data access patterns.

zeno

Netflix's In-Memory Data Propagation Framework

brutal

A multi-network asynchronous chat bot framework using twisted

vizceral-react

dispatch-docker

metaflow-service

🚀 Metadata tracking and UI service for Metaflow!

pytheas

Web Resources and UI Framework

dyno

Java client for Dynomite

hal-9001

Hal-9001 is a Go library that offers a number of facilities for creating a bot and its plugins.

Nicobar

lemur-docker

Docker files for the Lemur certificate orchestration tool

yetch

Yet-another-fetch polyfill library. Supports AbortController/AbortSignal