Welcome to Inedo Security Labs

Established in 2023, we're a team of security researchers that work closely with Inedo's product engineers, solution architects, and leadership to improve Software Supply Chain Security for our customers and beyond. We accomplish this through research (some of which is published in our SecLib), as well as advisory and consulting services.

We also curate the ProGet Vulnerability Database (PGVD), which is an aggregation of publicly-disclosed vulnerabilities from a variety of sources and malicious packages we've detected. In addition, we'll do easy-to-understand write-ups of prominent vulnerabilities, so that you don't have to be a security researcher yourself to learn how to protect yourself.

Latest Vulnerabilities Detected

CVSS Score	Vulnerability ID	Summary	Package
unfiled	PGV-2626500	flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key takes an array of paths to user defined licence files relative to the source directory of the module. The paths from that array are resolved using g_file_resolve_relative_path() and validated to stay inside the source directory using two checks - g_file_get_relative_path() which does not resolve symlinks and g_file_query_file_type() with G_FILE_QUERY_INFO_NOFOLLOW_SYMLINKS which only applies to the final path component. The copy operation runs on host. This can be exploited by using a crafted manifest and/or source to read arbitrary files from the host and capture them into the build output. This vulnerability is fixed in 1.4.8.	debian/flatpak-builder source (deb)
unfiled	PGV-2626508		debian/wolfssl source (deb)
unfiled	PGV-2626511		debian/wolfssl source (deb)
unfiled	PGV-2626510		debian/wolfssl source (deb)
unfiled	PGV-2626509		debian/wolfssl source (deb)

Meet the Inedo Security Labs Team

We're a small but focused team that reports directly to Inedo's CEO, Alex Papadimoulis. Our experience is diverse and over a range of domains and technologies, from Java in the banking sector to legacy Windows systems in mining, and advancements in cloud-native and machine learning. And although we're new to the Inedo team, we started with a ton of experience in Inedo's products.

Our Analysts

Pete Barnum

Senior Security Analyst

Pete has a background in regulatory compliance, with a focus on cybersecurity, SDLC auditing, risk management, disaster recovery, and IT vendor management. He's worked the Banking, Logistics, and Government sectors... but not yet the live/traveling entertainment industry.

Kim Pento

Chief Security Researcher

As Chief Security Researcher at Inedo Security Labs, Kim leverages her 20 years of expertise in cybersecurity in highly regulated sectors, oversees the team, and was a key figure alongside Alex Papadimoulis, CEO of Inedo, in the establishment of Inedo Security Labs.

Tod Hoven

Security Analyst

Tod is a former product engineer of ProGet transitioned into a career as a security researcher. Interested in analyzing and dissecting various software and systems to discover potential vulnerabilities and threats, vulnerability assessment, penetration testing, and threat modeling.