{"id":52757,"date":"2019-11-16T00:00:00","date_gmt":"2019-11-15T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/github-zapustil-sovmestnyj-proekt-dlya-vyyavleniya-uyazvimostej-v-otkrytom-po"},"modified":"2020-02-18T14:00:33","modified_gmt":"2020-02-18T11:00:33","slug":"github-zapustil-sovmestnyj-proekt-dlya-vyyavleniya-uyazvimostej-v-otkrytom-po","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/github-zapustil-sovmestnyj-proekt-dlya-vyyavleniya-uyazvimostej-v-otkrytom-po","title":{"rendered":"O GitHub lan\u00e7ou um projeto colaborativo para identificar vulnerabilidades em software livre.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GitHub falou<\/a><\/noindex> com a iniciativa GitHub Security Lab<\/a><\/noindex>, destinada a organizar a colabora\u00e7\u00e3o entre especialistas em seguran\u00e7a de v\u00e1rias empresas e organiza\u00e7\u00f5es para identificar vulnerabilidades e ajudar na sua corre\u00e7\u00e3o em c\u00f3digos de projetos abertos. <\/p>\n

Todas as empresas interessadas e especialistas individuais em seguran\u00e7a da informa\u00e7\u00e3o s\u00e3o convidados a se juntar \u00e0 iniciativa. Para a identifica\u00e7\u00e3o de vulnerabilidades est\u00e1 prevista<\/a><\/noindex> uma recompensa de at\u00e9 3000 d\u00f3lares, dependendo da gravidade do problema e da qualidade do relat\u00f3rio. Para enviar informa\u00e7\u00f5es sobre problemas, \u00e9 sugerido o uso da ferramenta CodeQL<\/a><\/noindex>, que permite criar um modelo de c\u00f3digo vulner\u00e1vel para verificar a presen\u00e7a de vulnerabilidades similares em outros projetos (CodeQL possibilita a realiza\u00e7\u00e3o de an\u00e1lises sem\u00e2nticas de c\u00f3digo e a cria\u00e7\u00e3o de consultas para buscar determinadas estruturas).<\/p>\n

Pesquisadores de seguran\u00e7a de empresas como F5, Google, HackerOne, Intel, IOActive, J.P. Morgan, LinkedIn, Microsoft, Mozilla, NCC Group, Oracle, Trail of Bits, Uber e
\nVMWare j\u00e1 se juntaram \u00e0 iniciativa e, nos \u00faltimos dois anos, identificaram<\/a><\/noindex> e ajudaram a corrigir<\/a><\/noindex> 105 vulnerabilidades em projetos como Chromium, libssh2, n\u00facleo Linux, Memcached, UBoot, VLC, Apport, HHVM, Exiv2, FFmpeg, Fizz, libav, Ansible, npm, XNU, Ghostscript, Icecast, Apache Struts, strongSwan, Apache Ignite, rsyslog, Apache Geode e Hadoop. <\/p>\n

O ciclo de vida de seguran\u00e7a do c\u00f3digo proposto no GitHub prev\u00ea que os participantes do GitHub Security Lab identifiquem vulnerabilidades, ap\u00f3s o que as informa\u00e7\u00f5es sobre os problemas ser\u00e3o comunicadas aos mantenedores e desenvolvedores, que trabalhar\u00e3o nas corre\u00e7\u00f5es, acordar\u00e3o o prazo para divulga\u00e7\u00e3o das informa\u00e7\u00f5es sobre o problema e informar\u00e3o os projetos dependentes sobre a necessidade de instalar a vers\u00e3o que corrige a vulnerabilidade. A base conter\u00e1 modelos CodeQL que ajudar\u00e3o a evitar o reaparecimento de problemas j\u00e1 resolvidos no c\u00f3digo presente no GitHub.
\n

\"O<\/a><\/noindex><\/center><\/p>\n

Atrav\u00e9s da interface do GitHub, agora \u00e9 poss\u00edvel obter<\/a><\/noindex> obter um identificador CVE para o problema identificado e preparar um relat\u00f3rio, enquanto o GitHub se encarregar\u00e1 de enviar as notifica\u00e7\u00f5es necess\u00e1rias e organizar sua corre\u00e7\u00e3o coordenada. Al\u00e9m disso, ap\u00f3s a corre\u00e7\u00e3o do problema, o GitHub enviar\u00e1 automaticamente pull requests para atualizar as depend\u00eancias relacionadas ao projeto vulner\u00e1vel.<\/p>\n

O GitHub tamb\u00e9m introduziu um cat\u00e1logo de vulnerabilidades GitHub Advisory Database<\/a><\/noindex>, que publica informa\u00e7\u00f5es sobre vulnerabilidades afetando projetos no GitHub, e dados para rastrear pacotes e reposit\u00f3rios vulner\u00e1veis. Os identificadores CVE mencionados nos coment\u00e1rios do GitHub agora referenciam automaticamente detalhes sobre a vulnerabilidade na base de dados apresentada. Para automatizar o trabalho com a base de dados, foi proposta uma separada API<\/a><\/noindex>.<\/p>\n

tamb\u00e9m h\u00e1 um relat\u00f3rio sobre a atualiza\u00e7\u00e3o um servi\u00e7o<\/a><\/noindex> para prote\u00e7\u00e3o contra a infiltra\u00e7\u00e3o<\/a><\/noindex> em reposit\u00f3rios publicamente acess\u00edveis
\ndados confidenciais, como tokens de autentica\u00e7\u00e3o e chaves de acesso. Durante o commit, o scanner verifica os formatos t\u00edpicos de chaves e tokens utilizados 20 provedores e servi\u00e7os de nuvem<\/a><\/noindex>, incluindo API Alibaba Cloud, Amazon Web Services (AWS), Azure, Google Cloud, Slack e Stripe. No caso de um token ser identificado, uma solicita\u00e7\u00e3o \u00e9 enviada ao provedor de servi\u00e7o para confirmar a viola\u00e7\u00e3o e revogar os tokens comprometidos. Desde ontem, al\u00e9m dos formatos anteriormente suportados, foi adiciona a suporte \u00e0 identifica\u00e7\u00e3o de tokens GoCardless, HashiCorp, Postman e Tencent.<\/p>\n

<\/a><\/noindex><\/p>\n

Fonte: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

GitHub \u0432\u044b\u0441\u0442\u0443\u043f\u0438\u043b \u0441 \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u043e\u0439 GitHub Security Lab, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044e \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u044b \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u043e\u0432 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u0441\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044e \u043f\u043e \u0438\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e \u0432 \u043a\u043e\u0434\u0435 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432. \u0414\u043b\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u0435 \u043f\u0440\u0438\u0433\u043b\u0430\u0448\u0430\u044e\u0442\u0441\u044f \u0432\u0441\u0435 \u0437\u0430\u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0438 \u0438\u043d\u0434\u0438\u0432\u0438\u0434\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u043f\u043e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0417\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0435\u0434\u0443\u0441\u043c\u043e\u0442\u0440\u0435\u043d\u0430 \u0432\u044b\u043f\u043b\u0430\u0442\u0430 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u044f \u0440\u0430\u0437\u043c\u0435\u0440\u043e\u043c \u0434\u043e 3000 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":52758,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-52757","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47GitHub lan\u00e7ou um projeto colaborativo para identificar vulnerabilidades em software aberto | ProHoster","description":"O GitHub lan\u00e7ou uma iniciativa","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/github-zapustil-sovmestnyj-proekt-dlya-vyyavleniya-uyazvimostej-v-otkrytom-po","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47GitHub \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043b \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u044b\u0439 \u043f\u0440\u043e\u0435\u043a\u0442 \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u041f\u041e | ProHoster","og:description":"GitHub \u0432\u044b\u0441\u0442\u0443\u043f\u0438\u043b \u0441 \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u043e\u0439","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/github-zapustil-sovmestnyj-proekt-dlya-vyyavleniya-uyazvimostej-v-otkrytom-po","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-15T21:00:00+00:00","article:modified_time":"2020-02-18T11:00:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52757","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 04:44:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:18:18","updated":"2026-01-24 04:44:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/52757","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=52757"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/52757\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media\/52758"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=52757"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=52757"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=52757"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}