OSSeva Blog
Insights on enterprise open source
CVE analysis, compliance guidance, migration playbooks, and open source strategy from engineers who run these systems in production.
Dependency Confusion Attacks: How They Work and How to Defend Your Supply Chain
Dependency confusion attacks exploit the way package managers resolve private package names against public registries. Understanding the attack vector and implementing registry scoping controls is now a baseline security requirement for any organisation with private package repositories.
Open Source Supply Chain Security: Protecting Your Pipeline from Malicious Packages
Malicious package injection — through typosquatting, maintainer account compromise, and build system attacks — has become the leading supply chain threat vector. We examine the attack patterns and the controls that actually work at enterprise scale.
Apache Tomcat CVEs: What Enterprise Java Teams Need to Know in 2025
Apache Tomcat 8.5 reached EOL in March 2024 and Tomcat 9.0 is approaching its own support boundary. We review the most significant Tomcat CVE patterns, the deployment configurations that amplify risk, and what remediation looks like without an immediate migration.
Kubernetes CVE-2023-2728: Understanding the NodeRestriction Admission Bypass
A bypass in Kubernetes' NodeRestriction admission plugin allowed a compromised node to escalate its own privileges by modifying pod labels used for security policy enforcement. We break down the mechanics and what hardened clusters should look like.
OpenSSL Vulnerability Management: Lessons from CVE-2022-0778 and CVE-2023-0286
OpenSSL sits at the foundation of nearly every TLS stack in the enterprise, making its vulnerability lifecycle uniquely high-stakes. Two recent CVEs illustrate why detection speed and patching automation matter more than any single advisory response.
PostgreSQL Security After EOL: What Changes When the Community Stops Patching
PostgreSQL's security record is excellent for a supported version. But for PostgreSQL 11, 12, and 13 — all of which have reached community EOL — the vulnerability lifecycle shifts from 'patch available' to 'no upstream fix.' Here is what enterprise teams need to understand.
Log4Shell Two Years Later: Why Enterprise Java Stacks Are Still Exposed
CVE-2021-44228 was patched in days, but thousands of enterprise applications still ship vulnerable Log4j transitive dependencies buried inside vendor JARs. We examine why detection is harder than it looks and what a sustainable remediation posture actually requires.
Apache Kafka Security: Known CVEs and What They Mean for EOL Versions
Apache Kafka's CVE history reveals a pattern of vulnerabilities in its authentication subsystem, the legacy ZooKeeper coordination layer, and the admin API. For teams on EOL 2.x and 3.0–3.4 releases, these issues are no longer being patched upstream.
RabbitMQ CVE Analysis: High-Severity Vulnerabilities in EOL Versions
RabbitMQ 3.8 through 3.12 are past community EOL and accumulating unpatched CVEs. We walk through the most significant vulnerabilities, their exploitability in enterprise deployments, and what a sustainable patching posture looks like.
Frequently asked questions
What topics does the OSSeva blog cover?
The OSSeva blog covers: CVE deep dives and technical analysis of vulnerabilities in enterprise open-source software, compliance and regulatory guidance for engineering and security teams, migration guides (Oracle to PostgreSQL, Tanzu to OSS RabbitMQ, Confluent to Kafka), EOL timelines and planning guides for major open-source projects, and operational best practices for RabbitMQ, Kafka, PostgreSQL, and Spring in enterprise environments.
Does OSSeva publish CVE analysis publicly?
Yes. OSSeva publishes technical CVE analysis for all remediations in our public vulnerability directory and expanded CVE deep-dives on the blog. These posts cover: the technical root cause of the vulnerability, how it can be exploited, which versions are affected, what the OSSeva patch does, and how to verify your deployment is fixed. These posts are designed for engineers who need to understand the vulnerability, not just apply a patch.