search

dependabot / elixir-security-advisories

Old database of Elixir security advisories before the GitHub Security Advisory DB supported Hex / Elixir.
Other
151 stars 9 forks source link
elixir security

readme

Deprecation Notice

This repo was created before the GitHub Security Advisory DB supported Hex / Elixir. Now that support has been added, we've deprecated / archived this repo. The Security Advisory DB is a much more flexible solution that includes an actual API, GraphQL support, auto-ingesting from various data sources, professional curation, etc.

elixir-security-advisories

Elixir Advisory Database

The Elixir Advisory Database is a repository of security advisories filed against published Elixir packages.

Advisory metadata is stored in YAML format for Sobelow, Dependabot, MixAudit and other automated tools to consume.

This is also an experimental web API for the database.

Build Status

Directory Structure

The database is a list of directories that match the names of Elixir libraries on [hex.pm]. Within each directory are one or more advisory files for the Elixir library.

packages/:
  plug/:
    2017-02-28.yml
    2017-02-28_2.yml

Format

Each advisory file contains the advisory information in YAML format:

---
id: 8268e120-60b4-4efb-b9ca-4e3faca0cca6
package: plug
disclosure_date: 2017-02-28
cve: 2017-1000052
link: https://elixirforum.com/t/static-and-session-security-fixes-for-plug/3913
title: |
  Null Byte Injection in Plug.Static

description: |
  Plug.Static is used for serving static assets, and is vulnerable to null
  byte injection. If file upload functionality is provided, this can allow
  users to bypass filetype restrictions.

  We recommend all applications that provide file upload functionality and
  serve those uploaded files locally with Plug.Static to upgrade immediately
  or include the fix below. If uploaded files are rather stored and served
  from S3 or any other cloud storage, you are not affected.

patched_versions:
  - ~> 1.3.2
  - ~> 1.2.3
  - ~> 1.1.7
  - ~> 1.0.4

unaffected_versions:
  - "< 1.0.0"

Schema

There is linting in place to enforce the following schema for each advisory:

Attribute Type Description
id String A version 4 UUID (use https://www.uuidgenerator.net/version4).
package String Name of the affected package.
disclosure_date Date Date the vulnerability was publicly disclosed (here or elsewhere).
cve String/Null (Optional) CVE assigned to the vulnerability.
link String Link to the original disclosure / more details.
title String Title of the vulnerability. This should be a (very) short description.
description String Description of the vulnerability.
patched_versions Array Array of Elixir requirement strings specifying patched versions.
unaffected_versions Array Array of Elixir requirement strings specifying unaffected versions.

Contributing

Do you know about a vulnerability that isn't listed in this database? Open an issue or submit a PR.

License

All content in this repository is placed in the public domain.

Public Domain