GitHub z inicijativo , aimed at organizing collaboration among security experts from various companies and organizations to identify vulnerabilities and assist in their remediation in open project code.
All interested companies and individual cybersecurity specialists are invited to join the initiative. For identifying vulnerabilities up to 3000 dollars is provided, depending on the severity of the issue and the quality of the report. To submit information about problems, a toolkit is offered , which allows creating a template of vulnerable code to detect similar vulnerabilities in other projects' code (CodeQL enables semantic code analysis and query formation for searching specific constructs).
Security researchers from companies such as F5, Google, HackerOne, Intel, IOActive, J.P. Morgan, LinkedIn, Microsoft, Mozilla, NCC Group, Oracle, Trail of Bits, Uber, and
VMware have already joined the initiative, helping to fix in The proposed GitHub code security maintenance lifecycle implies that GitHub Security Lab participants will identify vulnerabilities, after which information about the issues will be provided to maintainers and developers, who will develop fixes, agree on a timeline for disclosing information about the problem, and inform dependent projects about the need to install a version that fixes the vulnerability. CodeQL templates will be stored in the database to prevent the recurrence of resolved issues in the code present on GitHub.
Through the GitHub interface, it is now possible to
obtain a CVE identifier for the identified issue and prepare a report, while GitHub will automatically send the necessary notifications and coordinate their remediation. Moreover, after the problem is resolved, GitHub will automatically send pull requests to update dependencies related to the vulnerable project. GitHub has also included vulnerabilities in the stable directory
GitHub также ввёл в стой каталог уязвимостей , ki objavlja informacije o ranljivostih, ki vplivajo na projekte na GitHubu, ter podatke za sledenje prizadetim paketom in repozitorijem. CVE identifikatorji omenjeni v komentarjih na GitHubu sedaj avtomatsko povezujejo na podrobne informacije o ranljivosti v predloženi bazi podatkov. Za avtomatizacijo dela z bazo podatkov je predlagana ločena .
Prav tako je poročano o posodobitvi za zaščito pred v javno dostopne repozitorije
zaupnih podatkov, kot so avtentikacijski žetoni in ključi za dostop. Med zavezo skener preverja tipične formate ključev in žetonov, ki jih uporabljajo , vključno z API-jem za Alibaba Cloud, Amazon Web Services (AWS), Azure, Google Cloud, Slack in Stripe. V primeru odkritja žetona se storitvenemu ponudniku pošlje zahtevek za potrditev uhajanja in umik kompromitiranih žetonov. Od včeraj, poleg prej podprtih formatov, je dodana podpora za prepoznavanje žetonov GoCardless, HashiCorp, Postman in Tencent.
Izvor: opennet.ru
