Amazon Web Services (AWS) has added two new capabilities to its developer tool CodeGuru Reviewer, including checks against the Log4j vulnerability.
The machine learning service helps uncover security vulnerabilities in code while also offering suggestions for improving code quality.
RELATED RESOURCE
Seven leading machine learning use cases
Seven ways machine learning solves business problems
Building on these capabilities, AWS’ CodeGuru Reviewer now supports two new features: detector library and security detectors for log-injection flaws.
The detector library contains a detailed description of detectors used by CodeGuru Reviewer when searching for possible defects. Additionally, the library offers code samples in both Java and Python.
For each detector, CodeGuru Reviewer includes one noncompliant and one compliant code instance. The detectors are designed to pick up on a wide range of code defects.
In addition, CodeGuru employs machine learning and automated reasoning to identify potential errors. The result is that each detector can find additional defects on top of the one explicitly listed on its description page.
Secondly, new detectors for log-injection flaws address the problem described in CWE-117: Improper Output Neutralization for Logs. In particular, the new capability mitigates a recently discovered vulnerability in Apache Log4j.
“Following the recent Apache Log4j vulnerability, we introduced in CodeGuru Reviewer new detectors that check if you’re logging anything that is not sanitized and possibly executable,” explained AWS.
“Following these detectors, user-provided inputs must be sanitized before they are logged. This avoids having an attacker be able to use this input to break the integrity of your logs, forge log entries, or bypass log monitors.”
Detector library and new detectors for log-injection flaws are available across all AWS regions that offer Amazon CodeGuru Reviewer.
-
Trump's AI executive order could leave US in a 'regulatory vacuum'News Citing a "patchwork of 50 different regulatory regimes" and "ideological bias", President Trump wants rules to be set at a federal level
-
TPUs: Google's home advantageITPro Podcast How does TPU v7 stack up against Nvidia's latest chips – and can Google scale AI using only its own supply?
-
Security experts claim the CVE Program isn’t up to scratch anymore — inaccurate scores and lengthy delays mean the system needs updatedNews CVE data is vital in combating emerging threats, yet inaccurate ratings and lengthy wait times are placing enterprises at risk
-
IBM AIX users urged to patch immediately as researchers sound alarm on critical flawsNews Network administrators should patch the four IBM AIX flaws as soon as possible
-
Critical Dell Storage Manager flaws could let hackers access sensitive data – patch nowNews A trio of flaws in Dell Storage Manager has prompted a customer alert
-
Flaw in Lenovo’s customer service AI chatbot could let hackers run malicious code, breach networksNews Hackers abusing the Lenovo flaw could inject malicious code with just a single prompt
-
Industry welcomes the NCSC’s new Vulnerability Research Initiative – but does it go far enough?News The cybersecurity agency will work with external researchers to uncover potential security holes in hardware and software
-
Hackers are targeting Ivanti VPN users again – here’s what you need to knowNews Ivanti has re-patched a security flaw in its Connect Secure VPN appliances that's been exploited by a China-linked espionage group since at least the middle of March.
-
Broadcom issues urgent alert over three VMware zero-daysNews The firm says it has information to suggest all three are being exploited in the wild
-
Nakivo backup flaw still present on some systems months after firms’ ‘silent patch’, researchers claimNews Over 200 vulnerable Nakivo backup instances have been identified months after the firm silently patched a security flaw.
