Radar · 2022-03
March 2022
An infinite loop in OpenSSL's certificate parsing is reachable before any signature is verified, so a hostile certificate alone hangs the process, a maintainer ships code to node-ipc that overwrites files on any host geolocating to Russia or Belarus and Vue CLI picks it up automatically, SOCI Part 2A and the Data Availability and Transparency Act both clear Parliament in the final 48 hours before the election is called, two bundled third-party libraries force unplanned Drupal core releases six days apart, and Go 1.18 ships generics and quietly changes the build hash of unchanged source.
What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.
AI platform and models
Sections- fyi NIST
The AI Risk Management Framework gets its first full draft — nist.gov
NIST published the initial draft on 17 March 2022, building on a December 2021 concept paper and folding in the feedback received. Comment ran to 29 April, and NIST committed on the same page to a second draft and a third workshop before issuing AI RMF 1.0 in January 2023. Workshop #2 ran 29 to 31 March to gather input on this draft. The document was explicit that sections remained unbuilt, so it is best read as the point where the framework's structure rather than its detail was locked in.
This is the month to point at when a client asks how long AI governance frameworks take to arrive: concept paper in December 2021, first draft here, and a final version promised for January 2023.
- fyi AWS
Call analytics starts labelling issues and action items — aws.amazon.com
Amazon Transcribe Call Analytics added machine-learning-generated labelling of issues, outcomes and action items in customer calls during March 2022, moving from transcription plus sentiment towards structured summarisation of what a call was actually about and what was agreed.
Marginal for a web team directly, and worth knowing for one reason: this is the class of feature that turns a call recording from a compliance artefact into a searchable data set, which changes its privacy profile. If a client is considering it alongside a web presence you operate, the question to raise is retention — a labelled, indexed summary of a customer's problem is more sensitive than the audio it came from, not less.
Security and edge
Sections- critical Chrome
Chrome ships a single-fix V8 type-confusion patch for an in-the-wild exploit — chromereleases.googleblog.com
On 25 March 2022 Google updated Chrome 99 to 99.0.4844.84 with one security fix: CVE-2022-1096, a high-severity type confusion in V8, reported two days earlier. Google said an exploit existed in the wild and restricted bug details until most users had the fix.
Force a restart across the fleet. A single-fix stable update with an in-the-wild notice is the urgency signal — the advisory itself withholds the technical detail. Anyone running Electron or another embedded Chromium engine inherits V8 on that project's slower cadence.
- critical Firefox
Two exploited Firefox use-after-frees force an out-of-band release — mozilla.org
Mozilla shipped Firefox 97.0.2 and Firefox ESR 91.6.1 out of band on 5 March 2022 for CVE-2022-26485 and CVE-2022-26486. The first is a use-after-free reached by removing an XSLT parameter during processing; the second an unexpected message in the WebGPU IPC framework leading to a use-after-free and, in Mozilla's own words, an exploitable sandbox escape. Both advisories carry the same sentence — "We have had reports of attacks in the wild abusing this flaw" — and CISA added both to its known-exploited catalogue on 7 March with a 21 March remediation date. Thunderbird 91.6.2 and Firefox for Android 97.3 carried the same fixes.
Check the ESR line first, because 91.6.1 is what a managed government fleet runs and an out-of-band ESR build does not always reach it through the same channel as a normal release. Beyond the patch, this pair is the argument for treating Firefox on the same footing as Chrome in patch automation: the browser with the smaller share still gets exploited, and in 2022 it got there first.
- notable OpenSSL
A hostile certificate can hang OpenSSL before anything is verified — openssl-library.org
CVE-2022-0778, published 15 March 2022 and rated High, is an infinite loop in OpenSSL's BN_mod_sqrt, reachable whenever the library parses a certificate carrying an elliptic curve public key in compressed form, or explicit EC parameters with a compressed base point. The trap is the ordering: this parsing happens before signature verification, so an unauthenticated attacker only has to get a malformed certificate in front of the parser. Affected are 1.0.2, 1.1.0, 1.1.1 before 1.1.1n and 3.0 before 3.0.2. Fixed in 1.1.1n, 3.0.2 and 1.0.2zd under premium support only; 1.1.0 was already out of support and never received a fix. Reported by Tavis Ormandy of Google on 24 February.
Treat this as a fleet-wide TLS-terminator patch rather than an application patch, because the exposure is anywhere a certificate gets parsed — a client reaching a hostile server, a server configured for client certificates, a CA ingesting a request. Audit every load balancer, reverse proxy, WAF node and origin for its linked OpenSSL, including statically linked appliance firmware where the vendor controls the version. Anything still on a 1.1.0 branch needs a migration plan rather than a patch.
- notable Apache
httpd 2.4.53 closes request smuggling and a mod_sed memory bug — httpd.apache.org
Released 14 March 2022 with four CVEs, two of them rated important by the Apache security team. CVE-2022-22720 is HTTP request smuggling arising when httpd fails to close a connection after errors encountered discarding a request body, affecting everything up to and including 2.4.52. CVE-2022-23943 is a read and write beyond bounds in mod_sed, same affected range. The other two are lower: an uninitialised value in mod_lua's parsebody, and a buffer overflow with a very large or unlimited LimitXMLRequestBody.
The request smuggling flaw is the one to schedule around, and the reason is cache integrity rather than availability: smuggling against a caching tier is how a single poisoned response gets served to every subsequent visitor. Patch to 2.4.53, and if you cannot, confirm your edge normalises or rejects ambiguous Content-Length and Transfer-Encoding combinations before they reach httpd — which is a control you own regardless of the origin's version.
Standards and compliance
Sections- notable SOCI
SOCI Part 2A becomes law in the final 48 hours of the sitting period — aph.gov.au
The SLACIP Bill was introduced into the Senate on 30 March 2022, passed the Senate the same day, and finally passed both Houses on 31 March once the House agreed to the Senate's amendments. Those amendments were the price of industry concern about the breadth of the risk management program power. This is the second half of the package deliberately split in December 2021 so mandatory incident reporting could commence while the risk management provisions were still being negotiated.
This is the statutory origin of the Critical Infrastructure Risk Management Program obligation. Which assets it captures, and which frameworks satisfy it, are left to rules not yet made, so watch for those rules rather than planning against the Act alone.
- notable DATA Scheme
The DATA Act creates an authorised pathway for sharing Commonwealth data — legislation.gov.au
The Data Availability and Transparency Act 2022 received assent on 31 March 2022 and commenced the next day, establishing the DATA Scheme as an authorised pathway for Commonwealth bodies to share public sector data outside the existing patchwork of secrecy provisions. Sharing is permitted only for three purposes under section 15 — delivery of government services, informing government policy and programs, and research and development — and is barred for enforcement-related activities and national security purposes.
Read the purpose limits rather than the permission, because they are what constrain a project. A government client proposing to combine datasets for anything resembling compliance monitoring or enforcement is outside the scheme, and that is a design question rather than a legal footnote.
- fyi ASD
REDSPICE commits $9.9 billion to ASD over a decade — asd.gov.au
REDSPICE — Resilience, Effects, Defence, Space, Intelligence, Cyber, Enablers — was announced with the 2022-23 Budget in late March 2022, committing $9.9 billion over the decade to the Australian Signals Directorate. The Blueprint setting out the detail was published alongside it and states the figure — "$9.9 billion over the decade, the largest ever in cyber and intelligence capabilities" — with workforce growth of 1,900 over the same period.
The consequence for a vendor is capability rather than obligation — the Blueprint triples offensive cyber effects capability and doubles the analytic workforce, which is also a substantial increase in the volume of advisories, guidance and threat sharing an Australian operator is expected to absorb. If you are arguing for a standing process to track ACSC output rather than reading it ad hoc, this is the funding decision that justifies it.
CMS and platforms
Sections- notable Drupal
Two bundled libraries force unplanned Drupal core releases five days apart — drupal.org
March forced two unscheduled Drupal core updates in under a week, both from third-party libraries Drupal bundles. SA-CORE-2022-005 on 16 March, scored 13 out of 25, covers CKEditor: an attacker who can create or edit content — even without CKEditor access themselves — may be able to trigger cross-site scripting through an HTML processing flaw, with a second issue being regular-expression denial of service in the dialog plugin. Fixed in 9.2.15 and 9.3.8, with an explicit warning to check contributed modules and Webform for their own bundled CKEditor copies. Five days later SA-CORE-2022-006 shipped out of the normal release window because Guzzle had already published details of a PSR-7 issue.
The pattern is the finding: neither release was about Drupal's own code, and one of them was forced early because an upstream project disclosed first. That is a scheduling risk rather than a code risk — a bundled dependency can trigger an out-of-cycle update on someone else's timetable. The CKEditor warning is the concrete task: contributed modules and Webform ship their own copies, so patching core does not necessarily patch the editor your site actually loads.
- notable WordPress
WordPress patches prototype pollution twice in one release — wordpress.org
WordPress 5.9.2, released 11 March 2022, fixed three security issues and one bug. Two are prototype pollution — one in the bundled jQuery dependency and one in the block editor, the latter credited to researchers at Johns Hopkins University. The third is a stored cross-site scripting issue credited to Ben Bidner of the WordPress security team. All branches since 3.7 were updated. The announcement is unusually direct in telling site owners to update immediately.
The block editor prototype pollution is the one that matters on a government estate, because it lands in the authenticated editorial surface rather than the public front end — which makes it privilege-escalation-shaped between editor roles rather than an anonymous attack. Patch same day. The jQuery finding is also a prompt to check whether custom admin JavaScript relies on the bundled jQuery version, since that is where a second copy tends to hide.
- notable Statamic
Statamic 3.3 rewrites Antlers and drops PHP 7.2, 7.3 and Laravel 6 and 7 — statamic.com
Released 14 March 2022, Statamic 3.3 ships a complete rewrite of the Antlers template engine into a two-stage parser with an abstract syntax tree, bringing settable variables and syntax errors that report the exact line, character and error type. The new engine shipped under an opt-in feature flag until 3.4. Blade support gained magic page variables, frontend forms now apply control-panel conditional-field logic automatically with an included Alpine.js driver, and live preview became GraphQL-compatible. It adds Laravel 9 and drops Laravel 6 and 7. PHP 7.2 and 7.3 are no longer supported; 7.4 remains.
The requirements change is the gate: no Laravel 6 or 7, and no PHP 7.2 or 7.3, so a site on any of those needs a platform upgrade before the Statamic one. On the template rewrite, keep the new engine opt-in until you have tested existing templates — a parser that reports errors instead of failing silently will surface latent bugs.
Supply chain, CI/CD and IaC
Sections- critical npm
A library overwrites files based on where the host geolocates — bleepingcomputer.com
Between 15 and 17 March 2022 the maintainer of node-ipc shipped versions 10.1.1 and 10.1.2 containing code that geolocated the host by external IP and, if it resolved to Russia or Belarus, overwrote arbitrary files on disk with a heart emoji. node-ipc was pulling over a million weekly downloads. Vue CLI was the highest-profile casualty because it did not pin node-ipc and took the latest minor and patch automatically, so ordinary installs picked up the destructive versions. Later 11.0.0-series releases dropped the file destruction but still wrote a peace-message file to the user's desktop. CVE-2022-23812 was assigned.
Two months after the colors.js sabotage, the same failure mode with a destructive payload — which settles the argument that January was an isolated incident. The transferable rule is that a dependency's behaviour is not bounded by its purpose, so a transitive package with no business touching the filesystem can still be shipped code that does. Pin transitives, and note the second lesson from the 11.x releases: writing an unsolicited file to a user's desktop is still unsolicited write behaviour in a library, even when the payload is benign.
- notable GitHub Actions
Self-hosted runners can finally be limited to specific workflows — github.blog
From 21 March 2022 GitHub added the ability to restrict a self-hosted runner group so that only nominated workflows can use it. The problem it closes is one of the sharpest edges in CI: a self-hosted runner is a persistent machine, so anything that lands a job on it can read whatever the previous job left behind and, in the worst case, tamper with the toolchain for the next one. Before this control, any workflow in a repository with access to an organisation or enterprise runner group could target it, which meant a single lax repository put the whole runner at risk.
If you run self-hosted runners, apply this — the default before it was effectively shared mutable infrastructure across every workflow that could reach the group. GitHub's suggested pattern pairs it with reusable workflows, so a protected runner group can only be reached through a standard deployment workflow.
- fyi npm
Every npm account lands inside enhanced login verification — github.blog
From 1 March 2022 every npm account, not only publishers, was inside enhanced login verification, closing out a programme that began in December 2021. The two 24-hour brown-outs on 16 and 23 February did their job as a forcing function, giving non-compliant top-100 maintainers a chance to hit the wall before enforcement became permanent. March is the point where npm's baseline stopped being opt-in for anyone.
Nothing to configure, and worth understanding as a floor rather than a control: emailed one-time codes stop credential stuffing and do nothing against an attacker with mailbox access. The useful move is to get ahead of the next rung rather than waiting for it to reach you.
Languages, runtimes and frameworks
Sections- notable Go
Go 1.18 ships generics and changes the build hash of unchanged source — go.dev
Released 15 March 2022, the largest change to the language since 1.0. It added type parameters and with them the any alias and constraints, plus native fuzzing and workspace mode via go work. It is also the release from which the go command embeds version-control and build information into binaries by default (omit with -buildvcs=false). Under Go's support policy — each major is supported until two newer majors exist — 1.18's arrival ended the support window for 1.16.
For a hosting or CDN platform this is a build-reproducibility event as much as a language event: the embedded version-control stamping means binaries built with 1.18 differ byte-for-byte from 1.17 builds of identical source. Expect build hashes to change on the upgrade and adjust any reproducibility or artefact-diffing check before blaming your own code — this is the kind of thing that burns a day when it surprises you and costs nothing when it does not.
- notable Go
go1.17.8 patches regexp twelve days before the major — go.dev
go1.17.8 shipped on 3 March 2022 as a security release covering regexp/syntax. It landed twelve days before go1.18.0, so teams on the 1.17 line needed it independently of the major.
If you were holding on 1.17 to avoid the generics move — a reasonable position in March 2022 — take 1.17.8 rather than deferring the whole thing, because the security release and the language change are separate decisions that the calendar happened to collide. Worth checking that your version policy can express "patch this branch but do not adopt the next major", since a lot of them cannot.
Static site and web tooling
Sections- notable Hugo
Hugo 0.94 reformats every alias page and flips bare links to HTTPS — discourse.gohugo.io
Released 10 March 2022 and the clearest build-output-breaking Hugo release of the year. Alias pages — the redirect stubs Hugo emits for every aliases entry — changed from a one-liner with no trailing newline to ten lines of neatly indented HTML. Functionally identical, but a site with thousands of aliases produces a build diff touching thousands of files. Separately, linkifyProtocol now defaults to HTTPS, so bare links in content render with a different scheme than before, and the default handling of empty space changed. The release was primarily a performance push.
Know about the alias reformat before you look at the diff, because it makes a routine upgrade look catastrophic when nothing is wrong — and a reviewer who panics at a thousand-file diff will either block a safe deploy or start ignoring diffs, both of which are worse than knowing. The linkifyProtocol flip is the real change: bare links to HTTP-only endpoints in content will now be rendered as HTTPS, so check any internal or legacy host referenced that way.
- fyi SvelteKit
SvelteKit ships breaking changes monthly, with no majors to signal them — svelte.dev
The March "What's new in Svelte" post covers page endpoints arriving in SvelteKit. The context is more useful than the feature: SvelteKit spent the whole of 2022 in pre-1.0, shipping breaking changes monthly, and the project's monthly posts are its own record of them. The significant ones fall in April with fallthrough routes removed, August with load changes and Vite 3 support, and September with the filesystem router rework.
If you ran SvelteKit in 2022, treat the monthly Svelte posts as the changelog of record, because the breaking changes were not confined to major version boundaries — there were none. That is the general hazard with pre-1.0 dependencies in production: the version number carries no promise, so the only signal is the project's own narrative, and nothing in your tooling will surface it.
- fyi Jekyll
Jekyll ships twice, once to undo a Windows build machine — jekyllrb.com
Jekyll 4.2.2 on 3 March 2022 exists because 4.2.1 was built on Windows and shipped files with CRLF line endings rather than LF — harmless for most users, but it cost the jekyll executable its executable permission for third-party vendors repackaging the gem. Jekyll moved release builds to GitHub Actions on Ubuntu as a result. Jekyll 3.9.2 followed, adding Ruby 3.0 and 3.1 support and fixing a serve-time MIME issue.
Nothing to do unless you repackage the Jekyll gem, in which case 4.2.2 restores the executable bit. It is a small item that illustrates something worth internalising though: a defect in a project's own release toolchain only manifests downstream of the project, so the people who find it are never the people who can fix it. Worth remembering when your own build machine is the odd one out.
Build on what the radar tracks
Integrations
How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.
Learn moreAI applications
Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.
Learn moreFor developers
REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.
Learn more