Introducing a community-driven advisory database for third-party software dependencies

GitLab provides a Dependency Scanning

feature that can automatically detect vulnerabilities in your software

dependencies. Dependency Scanning covers various programming languages and

relies on the GitLab Advisory Database, that

is

updated

on a periodic basis by the

Vulnerability Research

team at GitLab. The GitLab Advisory Database covers security advisories in software packages that have a CVE identifier, as well as malicious packages marked as such by their ecosystem (example). The database is an essential part of

the Dependency Scanning feature, which is

available in GitLab Ultimate self-managed

and GitLab Ultimate SaaS.

As of recently, GitLab also provides a free and open-source version of the

database, the GitLab Advisory Database (Open Source Edition), a time-delayed

(+30 days) clone of the GitLab Advisory Database.

In the spirit of

Collaboration and

Transparency, two of

the GitLab core values, we share

the database with the open-source community in a format that is

well-documented

and can be easily parsed. The advisory data can be readily adopted, adapted, and

exchanged. For example, links to proof of concepts or write-ups, or any other

directly related information that will benefit the community, can be added to

the urls array:

urls:
  - "https://hackerone.com/reports/1104077"
  - "https://nvd.nist.gov/vuln/detail/CVE-2021-28965"
  - "https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965/"

Additionally, in our advisories we use Common Weakness Enumeration

in conjunction with Common Vulnerability Scoring System as a standard means

of communicating vulnerabilities, as well as their impact/severity, internally and externally.

The GitLab Advisory Database is integrated

into GitLab Dependency Scanning. Once

an existing advisory is modified or a new advisory is created, the information included in the advisory will appear

in the Vulnerability Pages

where findings/vulnerabilities originating from all security scanners,

including Dependency Scanning, can be managed at a central place.

The open-source database has recently been integrated into

Trivy, a free and open-source solution

for container scanning.

We are very grateful for community contributions

to the GitLab Advisory Database.

Our community has aided us by suggesting improvements to our data or by creating entirely new advisories, allowing everyone to benefit from their contributions.

At GitLab, everyone can contribute.

The Vulnerability Research

team at GitLab has made it easy to contribute to both databases.

Community contributions can be made available in

advisories-community

instantaneously by means of the community-sync flag,

which has been introduced recently. Using this synchronization, you can make

the same contribution appear in both databases at the time of a Merge Request

(within one hour after the merge).

We have also used this flag to make the advisories concerning the recent

log4Shell

vulnerabilities available to the community immediately after these were made public.

Even though the open-source version of the database is time-delayed, particular

vulnerabilities that have the potential to become widespread and cause

disruptions to the entire Internet, are pushed into the open-source version

of the GitLab security advisory database.

Cover image by Charles Deluvio on Unsplash