GitHub launched a collaborative project to identify vulnerabilities in open source software.

GitHub spoke with initiative GitHub Security Lab, aimed at bringing together security experts from various companies and organizations to identify vulnerabilities and assist in their resolution in the code of open projects.

All interested companies and individual cybersecurity experts are invited to join the initiative. A reward is provided for identifying vulnerabilities of up to $3000, depending on the severity of the issue and the quality of the report. It is proposed to use the toolkit CodeQL, which allows for the creation of a vulnerable code template to identify similar vulnerabilities in the code of other projects (CodeQL provides capabilities for semantic code analysis and allows for queries to search for specific constructs).

Security researchers from companies such as F5, Google, HackerOne, Intel, IOActive, J.P. Morgan, LinkedIn, Microsoft, Mozilla, NCC Group, Oracle, Trail of Bits, Uber and
VMWare have already joined the initiative, who over the past two years identified and have helped fix 105 vulnerabilities in projects like Chromium, libssh2, the Linux kernel, Memcached, UBoot, VLC, Apport, HHVM, Exiv2, FFmpeg, Fizz, libav, Ansible, npm, XNU, Ghostscript, Icecast, Apache Struts, strongSwan, Apache Ignite, rsyslog, Apache Geode, and Hadoop.

The proposed GitHub security code maintenance lifecycle implies that the participants in GitHub Security Lab will identify vulnerabilities, after which the information about the issues will be communicated to maintainers and developers, who will work on fixes, coordinate the timing of disclosing information about the problem, and inform dependent projects about the need to install the version with the vulnerability resolved. CodeQL templates will be placed in the database to prevent the recurrence of resolved issues in the code present on GitHub.

Through the GitHub interface, it is now possible to get assign a CVE identifier for the identified issue and prepare a report, and GitHub will automatically send the necessary notifications and organize their coordinated resolution. Moreover, after the issue is resolved, GitHub will automatically send pull requests to update dependencies related to the vulnerable project.

GitHub has also introduced a directory of vulnerabilities the GitHub Advisory Database, which publishes information about vulnerabilities affecting projects on GitHub, along with data for tracking vulnerable issues in packages and repositories. CVE identifiers mentioned in GitHub comments now automatically link to detailed vulnerability information in the provided database. To automate interactions with the database, a separate API.

update has also been reported service to protect against the leakage of in publicly accessible repositories
sensitive data such as authentication tokens and access keys. During commits, the scanner checks standard formats of keys and tokens used by 20 cloud providers and services, including APIs for Alibaba Cloud, Amazon Web Services (AWS), Azure, Google Cloud, Slack, and Stripe. If a token is detected, a request is sent to the service provider to confirm the leak and revoke the compromised tokens. As of yesterday, support has been added for detecting tokens from GoCardless, HashiCorp, Postman, and Tencent, in addition to previously supported formats.

Source: opennet.ru