The Patching Friars' AlmanacA calendar of CVE saints

June 2

Ripple20Holy card for ripple20, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 XIX Ripple20 UNDA PER CATENAM
🤖 Image and text generated with AI

⬇ Download holy card: ·

☀ Commemorated today: The Miracle of Operation Tovar (2014)

Embed on your site

Saint Ripple20, Who Rippled the Supply Chain

Patron of embedded TCP/IP libraries, devices nobody will ever update, and waves that travel far.

Life

In June 2020 researchers at JSOF revealed nineteen vulnerabilities in the Treck TCP/IP stack, a small library hidden for decades inside printers, infusion pumps, UPSes and industrial machinery from dozens of vendors. Some allowed remote code execution with a well-crafted packet. The name comes from the ripple effect: one stone dropped into a single supplier, and the waves reach hundreds of millions of devices.

Prayer

O Saint Ripple20, who shakes a thousand companies from one small stack, let every vendor know what is inside its firmware. Amen.

How to celebrate

Celebrated by updating the Treck stack, asking vendors for an SBOM and skipping a stone across a pond to see how far it goes.

Small stone, long ripple.

Technical record

Disclosed on
June 2 2020
CVE
CVE-2020-11896CVE-2020-11897CVE-2020-11898

The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling.

Sources: jsof-tech.com · forescout.com · web.archive.org

Commemorated today

Also remembered today

Shortcuts: ← → to move, D day, W week, M month, T today.

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.