4 ms·
Interesting. I don’t fully understand the attack vector, but would it be possible to identify still vulnerable users by searching for e.g. GitHub repos that hav
by appplication 3y ago
Interesting. I don’t fully understand the attack vector, but would it be possible to identify still vulnerable users by searching for e.g. GitHub repos that have versions pinned to these older versions of these libraries or that use dependency versions that enforces a range under these versions?
E.g. if I know pillow<5.0.1 (just making a version up) has this, it’s pretty trivial to find projects still using that. I know folks using e.g. pyproj that are entirely unaware of any need to update this.
- robertlagrant 3y agoOWASP's DependencyTrack[0] lets you keep track of your released versions' dependencies post-release. [0] https://github.com/DependencyTrack/dependency-track https://github.com/DependencyTrack/dependency-track
- robszumski 3y agoDependencyTrack catalogs SBOMs and this is a perfect use case for them. Per parent comment, make sure your SBOM contains transitive dependencies!
- teraflop 3y agoGitHub has done exactly that for several years: https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts https://docs.github.com/en/code-security/dependabot/dependab... However, that approach will only find vulnerable dependencies in Git repositories, not ones that exist in already-published binary artifacts.