Jump to content
OKQL

GitHub to devs: Now you'll get security alerts on flaws in popular software libraries

Recommended Posts

GitHub's new service will help developers clean up vulnerable project dependencies.

githubsecurityalert.png

 

Devlopers can view the security alerts in the repository's dependency graph, which can be accessed from 'Insights'.

Image: GitHub

Development platform GitHub has launched a new service that searches project dependencies in JavaScript and Ruby for known vulnerabilities and then alerts project owners if it finds any.

 

The new service aims to help developers update project dependencies as soon as GitHub becomes aware of a newly announced vulnerability.

 

GitHub will identify all public repositories that use the affected version of the dependency. Projects under private repositories will need to opt into the vulnerability-detection service.

 

The alerts should have a big impact on security, given that GitHub now hosts nearly 70 million repositories, with projects that rely on dependent software packages or software libraries that frequently do not get updated when new flaws are disclosed.

 

The alerts form part of GitHub's so-called 'dependency graph', which helps developers monitor projects that their code depends on, and lists a project's various Ruby and JavaScript dependencies.

 

Developers can view the security alerts in the repository's dependency graph, which can be accessed from 'Insights'.

 

The alerts are only sent to project owners and others with admin access to repositories. The company promises never to publicly disclose vulnerabilities for a specific repository. Users can choose to receive the alerts by email, web notifications or the GitHub interface.

 

GitHub's is also using machine learning to suggest fixes from the GitHub community.

 

The alerts are based on public vulnerabilities in Ruby gems and NPM, the package manager for Node.js, on MITRE's Common Vulnerabilities and Exposures (CVE) List. GitHub will add Python to its vulnerability alert service in 2018.

 

Python, Ruby, and JavaScript are among the top five languages on GitHub, along with Java and PHP.

 

It appears the alerts will be limited to flaws with CVE IDs initially. However, as GitHub notes many publicly disclosed flaws don't have CVE IDs. It suggests future improvements will help it identify more vulnerabilities as it collects more data about them.

 

Source: zdnet.com

  • Upvote 1

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×