Patch management is far easier said than done, and security teams may often be forced into prioritising fixes for several business-critical systems, all released at once. It’s become typical, for example, to expect dozens of patches to be released on Microsoft’s Patch Tuesday, with other vendors also routinely getting in on the act.

Below, IT Pro has collated the most pressing disclosures from the last seven days, including details such as a summary of the exploit mechanism, and whether the vulnerability is being exploited in the wild. This is in order to give teams a sense of which bugs and flaws might pose the most dangerous immediate security risks.

Zero-day flaws in multiple VMware products
VMware has warned customers about a critical command injection flaw in a number of its products, including Workspace One Access and Identity Manager, for which a patch is not currently available.
The critical vulnerability, tracked as CVE-2020-4006, could allow hackers to take control of vulnerable machines if successfully exploited. To do so, they would need to be armed with network access to the administrative configurator on port 8443, as well as a valid password to the admin account.

With a patch still in development, VMware has outlined a workaround that can be applied to some product lines, but not all. Potentially affected customers should consult the security advisory and follow the steps outlined to safeguard their systems.

Facebook Messenger calling bug
Facebook patched a vulnerability in its widely-used Messenger app for Android that could have allowed a remote attacker to call targets and listen to them before they picked up an audio call.

Discovered by Google’s Project Zero researcher Natalie Silvanovich, the flaw could have granted an attacker logged into the app the ability to initiate a call and send a specially crafted message to targets signed into multiple devices. This would trigger a scenario where, when the device is ringing, the caller would receive audio either until the person being called answers, or the call times out.

The bug lay in the WebRTC framework Session Description Protocol (SDP), which defines a format for the streaming of media between two endpoints, and has since been fixed.

GitHub patches severe three-month-old flaw
The development platform GitHub has released a fix for a bug that was first reported more than three months ago by Google’s Project Zero security research team.

The flaw, which Google argues is highly-severe but GitHub insists is moderately-severe, affected the developer workflow automation tool, known as Actions. This was highly susceptible to injection attacks, according to researcher Felix Wilhelm, and GitHub finally addressed the bug by disabling the feature’s runner commends.

Remarkably, Google first informed GitHub of the flaw in August, but held back on publishing details in accordance with its 90-day disclosure policy. Google then granted GitHub a further 14-day grace period in which to fix the flaw, before finally revealing its existence on 2 November. Although GitHub requested an additional 48 hours, this was denied, and the details were published. The bug was subsequently patched on 16 November.

Warnings over MobileIron Android vulnerability
The National Cyber Security Centre (NCSC) has warned businesses about a vulnerability that can compromise the networks of UK organisations if successfully exploited.

Tagged as CVE-2020-15505, the remote code execution flaw affects the MobileIron Core and Connector software, which forms the company’s mobile device management (MDM) suite. It also affected the Monitor and Reporting Database software.

Although a patch was released in June 2020, organisations that haven’t updated their systems might be vulnerable to attack. Nation-state hackers have been attempting to exploit the vulnerability since the publication of a proof-of-concept exploit in September, according to the NCSC.

2FA brute-force bypass flaw on cPanel
The cPanel & WebHost Manager (WHM) web hosting platform contained a vulnerability that could have allowed hackers to effectively bypass the two-factor authentication (2FA) mechanism.

The now-fixed 2FA cPanel Security Policy inadvertently allowed users to repeatedly submit 2FA codes, essentially allowing attackers to bypass the 2FA check using brute force techniques. Although user credentials were required to gain access to the 70 million sites hosted on the platform, the exploit still bypassed a crucial additional layer of security that many users rely on. To fix the situation, incorrect 2FA codes are now treated as the equivalent of a failed password validation attempt.

The data generated in DevOps runs very well into exabytes. Not only it becomes difficult for the DevOps team to effectively absorb the data but also makes it challenging for them to apply solutions from this massive amount of data. The data generated by continuous integration and tools deployment is humongous. In fact, simple issues such as finding critical events usually take hundreds of hours. The number of integrations, the success rate, and defects per integration is only useful when they are timely evaluated and correlated.

Given such a situation, there have been increased efforts to integrate AI into DevOps, which helps save time and increase efficiency. It is expected that in the near future AI will be able to emerge as a tool to compute, analyse and transform how teams develop and manage applications. Apart from its conventional use in the DevOps environment, AI can also prove to be beneficial in addressing security issues and data leaks, for organising memory management, and in garbage collection.

Here are five ways in which AI can transform DevOps:
Software Testing
DevOps includes different types of testing, such as regression testing, functional testing, and user-acceptance testing. These tests generate a large amount of data. AI, in such a situation, can prove to smoothen the system to a great extent. It identifies patterns of such collected data and then evaluates the coding practice that led to an error. Such systems eliminate test coverage overlaps, optimise current testing mechanisms and accelerate from just defect detection to defect prevention. It can also identify module interdependencies, thereby improving the overall product quality.

Managing Project Requirements
Several organisations have introduced AI-enabled digital assistants that can analyse documents, identify inconsistencies, and recommend solutions. Powered by natural language processing, such systems are trained on referenced guidelines to learn high-quality writing requirements. If done manually, the whole process of requirement management, which includes gathering, validating, tracking user requirements, would cause grave delays and in worse cases, complete failure of the final project. With automation in place, the requirements review is more streamlined. In fact, as per a report, such tools helped in reducing the requirement review time by over 50%.

Security
Security is one of the most critical aspects of the DevOps system. Businesses need to protect themselves from security breaches and distributed denial of service (DDoS) attacks. AI and machine learning can be used to identify the abnormal condition and take corrective actions accordingly. Further, AI can be used to augment DevSecOps and improve security by recording threats and deploying an ML-based central logging architecture for anomaly detection.

In Application Development & Enhancement
AI can also be used to help developers during the application process. AI-systems can examine build-compile success, testing completions, and operational performance of the past applications to make recommendations to the developers on the code they are writing. Further, monitoring tools using machine learning can gather information about log files, performance metric, and datasheets to identify issues in advance and make appropriate alterations to the application.
Managing Alerts
DevOps encourages ‘fail, but fail fast’; considering this, the system needs to be quick in identifying the flaw and sound alert. However, with conventional systems, all incoming alerts are marked with the same severity, making it difficult for the team to react. AI learns several factors such as the magnitude of the alert, past behaviour, and the source of the alert. This way, the team is assisted in prioritising their responses to the alerts without overwhelming the system.

Wrapping Up
AI in DevOps helps in directing human intelligence and creativity towards more intricate projects and tasks, while it helps with managing the efficiency, speed and productivity of the task, which in turn enhances the customer experience. AI is delivered value to DevOps by auto-suggesting code segments, improving quality assurance techniques, and streamlining requirement management.

The downside of deploying AI-based DevOps is with open-source projects, where the developers may unintentionally propagate security risks into their codes. It is important that AI is introduced in a controlled manner to ensure that they become the backbone of the DevOps system and not act as rogue elements that need constant remediation.