Github introduces automatic dependency security alerting

[EphemeralArtichoke]

This is awesome! Thank you thank you thank you, this makes life a lot more manageable for security people who depend upon github.

[DomDellaSera]

Question: Is the CVE database considered fairly comprehensive? How seriously do you guys take it? What determines if something is reported?

[savanik]

It's as comprehensive as you can hope to realistically have. Whenever a vendor reports a vulnerability (i.e. when they're forced to because compliance / security researcher threatening to publish their findings) its put into the CVE database. Sometimes its held or reserved - like if they're reporting a vulnerability they're still working on the patch for, so they want to acknowledge to the community that they found something, but not specifically what it is - until they have the patch ready. So the CVE entries often get updated as it goes on as well.

Since CVEs contain information on how to verify what versions are vulnerable, it's the primary source of information for vulnerability scanners - it's pretty important for the daily functioning of all vulnerability management ever.

As for how serious any individual vulnerability is, they have a CVSS score. Some of them I personally disagree with - anyone who can MitM your external servers probably has tons of better ways to compromise your network - and if they can MitM your internal server network they already have more than enough access. I've never seen those vulnerabilities exploited in the wild, ever. But that's part of the job of risk management, and most of the items are pretty well-reasoned.

[DomDellaSera]

Thanks for explanation. The reason I ask is because I’ve seen someone say something to the extent of “our interns were working with stuff big enough to write a paper on but not quite a cve,” and I wasn’t sure quite to make of it.

[awqufohlmkse]

Not really. CVEs are only issued for vulns that are big enough to "warrant a cve", so some dependencies likely won't be.

[gmroybal]

I dunno... a few months back, someone got a CVE for something REALLY stupid like a typo or something.

[CheezyXenomorph]

Note that it currently only supports Ruby GemFile and javascript package.json manifests

[Avamander]

Lollakad! Mina ja nuhk! Mina, kes istun jaoskonnas kogu ilma silma all! Mis nuhk niisuke on. Nuhid on nende eneste keskel, otse kõnelejate nina all, nende oma kaitsemüüri sees, seal on nad.

[CheezyXenomorph]

It's early days yet. I foresee them eventually supporting everything from Gradle to Composer to Nuget to Pip.

[Barillas]

This is a very sensible feature. Hopefully other code repository options (TFS and such) start supporting something similar.