Wargames - Java Vulnerabilities and Why You Should Care
summary
Explains that Log4Shell (CVE-2021-44228) had CVSS jump from 9.3 to 10 and that many systems still pull vulnerable Log4j (about 34% months later), cites NVD/CVE/CWEs and 20,142 new vulnerabilities in 2021 and a 742% rise in supply‑chain attacks. Recommends quarterly CPU updates, using jlink to remove unused modules, and scanning shift‑left plus CI. Shows a JavaFX JDK‑update checker (15,000+ downloads) and an agentless production detector that fingerprints loaded classes to confirm whether a vulnerable library is actually used.
AI-written summary · about
chapters (20)
- 0:00Introduction to Java vulnerabilities
- 3:13Evolution of software security
- 7:22CWE, CVE and NVD explained
- 9:26OpenJDK vulnerability group
- 10:30Java release cycle and security
- 12:59Java updates CPU vs PSU
- 14:24Impact of not updating JDKs
- 16:10Modular runtime images with jlink
- 17:54Software supply chain risks
- 21:42Open source license risks
- 22:44Shift left and DevSecOps
- 24:49Rising software supply chain attacks
- 25:53Log4Shell vulnerability impact
- 27:41Tools and strategies for security
- 30:49Static code analysis tools
- 32:32Vulnerability scanners in CI/CD
- 37:09Production security with Azul
- 40:01Building a secure software supply chain
- 41:03Key takeaways and recommendations
- 42:46Q&A session
related talks
49mWargames - Java vulnerabilities and why you should care
45mWargames - Java vulnerabilities and why you should care
49mThe Anatomy of Java Vulnerabilities
56mThe Anatomy of Java Vulnerabilities
46mThe Anatomy of Java Vulnerabilities
48mThe Hidden Security Hazards in Your Java Stack
50mStranger Danger: Your Java Attack Surface Just Got Bigger
48mCommon vulnerabilities you wish your Java app didn't have!