Wargames - Java vulnerabilities and why you should care
summary
Explains CVE/NVD/CVSS scores and shows concrete risks: JDK 17 accumulates ~61 public CVEs if left unpatched, and quarterly CPU vs PSU timing matters because a PSU (example 8u252 PSU broke Hadoop/Solr in production) can introduce nonsecurity changes that fail systems while CPUs only backport fixes. Demonstrates hard numbers and fixes: a full JDK image drops from 69 modules/339 MB to 11 modules/48 MB with jlink, recommends SDKMAN and the jdk‑mon app for automated updates, and surveys scanners (Snyk, SonarQube, Trivy, Black Duck and JVM production agents) with tradeoffs in false positives and runtime overhead.
AI-written summary · about
chapters (24)
- 0:00Intro
- 0:40Lock for Shell
- 2:50Vulnerability definitions
- 7:47Is Java secure
- 9:39Open Vulnerability Advisory
- 10:39Java Release Cycle
- 12:07How does this affect security
- 13:07Updates
- 21:18Software supply chain
- 22:47Statistics
- 26:31Open Source
- 27:02I owe you nothing
- 28:25Shift Left
- 28:59Dev Ops
- 29:47Update JDK
- 31:53Static code analysis
- 32:47Find Security Box
- 33:13Vulnerability scanners
- 34:28Java agent
- 35:40Sneakcode
- 36:28Sonar Cube
- 38:47Validate Right
- 39:55Takeaway
- 40:48Questions
related talks
49mWargames - Java vulnerabilities and why you should care
44mWargames - Java Vulnerabilities and Why You Should Care
56mThe Anatomy of Java Vulnerabilities
49mThe Anatomy of Java Vulnerabilities
46mThe Anatomy of Java Vulnerabilities
48mCommon vulnerabilities you wish your Java app didn't have!
27mModern Java: Change is the Only Constant
43mSteel for Vulnerabilities, Silver for Zombies: Hunting Java's Unseen Monsters