{"id":52757,"date":"2019-11-16T00:00:00","date_gmt":"2019-11-15T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/github-zapustil-sovmestnyj-proekt-dlya-vyyavleniya-uyazvimostej-v-otkrytom-po"},"modified":"2020-02-18T14:00:33","modified_gmt":"2020-02-18T11:00:33","slug":"github-zapustil-sovmestnyj-proekt-dlya-vyyavleniya-uyazvimostej-v-otkrytom-po","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/github-zapustil-sovmestnyj-proekt-dlya-vyyavleniya-uyazvimostej-v-otkrytom-po","title":{"rendered":"GitHub har lanserat ett samarbetsprojekt f\u00f6r att identifiera s\u00e5rbarheter i \u00f6ppen k\u00e4llkod.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GitHub talade<\/a><\/noindex> med initiativet GitHub Security Lab<\/a><\/noindex>, med fokus p\u00e5 att organisera samarbete mellan s\u00e4kerhetsexperter fr\u00e5n olika f\u00f6retag och organisationer f\u00f6r att identifiera s\u00e5rbarheter och hj\u00e4lpa till med deras l\u00f6sning i koden f\u00f6r \u00f6ppna projekt. <\/p>\n

Alla intresserade f\u00f6retag och individuella dators\u00e4kerhetsspecialister inbjuds att delta i initiativet. F\u00f6r att identifiera s\u00e5rbarheten erbjuds<\/a><\/noindex> ett belopp p\u00e5 upp till 3000 dollar, beroende p\u00e5 hur allvarligt problemet \u00e4r och kvaliteten p\u00e5 rapporten. F\u00f6r att rapportera problem rekommenderas att anv\u00e4nda verktyget CodeQL<\/a><\/noindex>, som g\u00f6r det m\u00f6jligt att skapa en mall f\u00f6r s\u00e5rbar kod f\u00f6r att identifiera liknande s\u00e5rbarheter i kod fr\u00e5n andra projekt (CodeQL g\u00f6r det m\u00f6jligt att utf\u00f6ra semantisk kodanalys och formulera fr\u00e5gor f\u00f6r att s\u00f6ka efter specifika konstruktioner).<\/p>\n

Initiativet har redan f\u00e5tt st\u00f6d av s\u00e4kerhetsforskare fr\u00e5n f\u00f6retag som F5, Google, HackerOne, Intel, IOActive, J.P. Morgan, LinkedIn, Microsoft, Mozilla, NCC Group, Oracle, Trail of Bits, Uber och
\nVMWare, som under de senaste tv\u00e5 \u00e5ren har uppt\u00e4ckt<\/a><\/noindex> och har hj\u00e4lpt till att \u00e5tg\u00e4rda<\/a><\/noindex> 105 s\u00e5rbarheter i projekt som Chromium, libssh2, Linux-k\u00e4rnan, Memcached, UBoot, VLC, Apport, HHVM, Exiv2, FFmpeg, Fizz, libav, Ansible, npm, XNU, Ghostscript, Icecast, Apache Struts, strongSwan, Apache Ignite, rsyslog, Apache Geode och Hadoop. <\/p>\n

Den f\u00f6reslagna livscykeln f\u00f6r kods\u00e4kerhet underh\u00e5lls av GitHub inneb\u00e4r att deltagarna i GitHub Security Lab kommer att identifiera s\u00e5rbarheter, efter vilken information om problemen kommer att \u00f6verl\u00e4mnas till underh\u00e5llare och utvecklare, som kommer att arbeta fram l\u00f6sningar, best\u00e4mma tidsramar f\u00f6r offentligg\u00f6rande av probleminformation och informera beroende projekt om behovet av att installera versioner med \u00e5tg\u00e4rdade s\u00e5rbarheter. I databasen kommer CodeQL-mallar att publiceras f\u00f6r att f\u00f6rhindra upprepade problem i koden p\u00e5 GitHub.
\n

\"GitHub<\/a><\/noindex><\/center><\/p>\n

Genom GitHub:s gr\u00e4nssnitt kan man nu f\u00e5<\/a><\/noindex> CVE-ID f\u00f6r det identifierade problemet och f\u00f6rbereda en rapport, och GitHub kommer sj\u00e4lvt att skicka n\u00f6dv\u00e4ndiga aviseringar och organisera deras samordnade \u00e5tg\u00e4rd. Dessutom, efter att problemet har l\u00f6sts, kommer GitHub automatiskt att skicka pull-f\u00f6rfr\u00e5gningar f\u00f6r att uppdatera beroenden kopplade till det s\u00e5rbara projektet.<\/p>\n

GitHub har ocks\u00e5 lagt till i katalogen \u00f6ver s\u00e5rbarheter GitHub Advisory Database<\/a><\/noindex>, d\u00e4r information om s\u00e5rbarheter som p\u00e5verkar projekt p\u00e5 GitHub publiceras, samt information f\u00f6r att sp\u00e5ra p\u00e5verkan p\u00e5 paket och f\u00f6rr\u00e5d. CVE-id som n\u00e4mns i kommentarer p\u00e5 GitHub l\u00e4nkas nu automatiskt till detaljerad information om s\u00e5rbarheten i den presenterade databasen. F\u00f6r att automatisera arbetet med databasen f\u00f6reslogs en separat API<\/a><\/noindex>.<\/p>\n

Det rapporteras ocks\u00e5 om en uppdatering tj\u00e4nsten<\/a><\/noindex> f\u00f6r att skydda mot l\u00e4ckage av<\/a><\/noindex> i offentligt tillg\u00e4ngliga f\u00f6rr\u00e5d
\nav k\u00e4nslig information, s\u00e5som autentiseringstoken och \u00e5tkomstnycklar. Under commit-processen kontrollerar skannern typiska format f\u00f6r nycklar och token som anv\u00e4nds av 20 molnleverant\u00f6rer och tj\u00e4nster<\/a><\/noindex>, inklusive API:er f\u00f6r Alibaba Cloud, Amazon Web Services (AWS), Azure, Google Cloud, Slack och Stripe. Om en token uppt\u00e4ckts skickas en f\u00f6rfr\u00e5gan till tj\u00e4nsteleverant\u00f6ren f\u00f6r att bekr\u00e4fta l\u00e4ckan och \u00e5terkalla de komprometterade token. Fr\u00e5n och med ig\u00e5r, ut\u00f6ver de tidigare st\u00f6dda formaten, har st\u00f6d f\u00f6r identifiering av token fr\u00e5n GoCardless, HashiCorp, Postman och Tencent lagts till.<\/p>\n

<\/a><\/noindex><\/p>\n

K\u00e4lla: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

GitHub \u0432\u044b\u0441\u0442\u0443\u043f\u0438\u043b \u0441 \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u043e\u0439 GitHub Security Lab, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044e \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u044b \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u043e\u0432 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u0441\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044e \u043f\u043e \u0438\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e \u0432 \u043a\u043e\u0434\u0435 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432. \u0414\u043b\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u0435 \u043f\u0440\u0438\u0433\u043b\u0430\u0448\u0430\u044e\u0442\u0441\u044f \u0432\u0441\u0435 \u0437\u0430\u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0438 \u0438\u043d\u0434\u0438\u0432\u0438\u0434\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u043f\u043e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0417\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0435\u0434\u0443\u0441\u043c\u043e\u0442\u0440\u0435\u043d\u0430 \u0432\u044b\u043f\u043b\u0430\u0442\u0430 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u044f \u0440\u0430\u0437\u043c\u0435\u0440\u043e\u043c \u0434\u043e 3000 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":52758,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-52757","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47GitHub har startat ett samarbetsprojekt f\u00f6r att uppt\u00e4cka s\u00e5rbarheter i \u00f6ppen k\u00e4llkod | ProHoster","description":"GitHub lanserade en initiativ","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/github-zapustil-sovmestnyj-proekt-dlya-vyyavleniya-uyazvimostej-v-otkrytom-po","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47GitHub \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043b \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u044b\u0439 \u043f\u0440\u043e\u0435\u043a\u0442 \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u041f\u041e | ProHoster","og:description":"GitHub \u0432\u044b\u0441\u0442\u0443\u043f\u0438\u043b \u0441 \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u043e\u0439","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/github-zapustil-sovmestnyj-proekt-dlya-vyyavleniya-uyazvimostej-v-otkrytom-po","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-15T21:00:00+00:00","article:modified_time":"2020-02-18T11:00:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52757","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 04:44:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:18:18","updated":"2026-01-24 04:44:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/52757","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=52757"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/52757\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media\/52758"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=52757"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=52757"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=52757"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}