Forwarded from Vulnerability Management and more
#GitHub recently introduced some great initiatives to improve the security of open-source products and libraries. They provided free access to CodeQL code analysis solution, created the global security research community GitHub Security Lab, became the CVE Numbering Authority (CNA) and provided a new way to apply for the CVE id directly from the GitHub interface. Moreover, they will automatically inform the affected projects if a vulnerability is found in some dependencies and will even make a pull request to fix the problem! And they will also scan for leaked credential tokens. Lots of great stuff!
GitHub made their own CVE-based Vulnerability Database with good mapping to commits and affected packages. The only thing is missing there - EXPLOITs.
And now the #Vulners Team makes it even better! Now you can search for GitHub advisories at Vulners and see the links to exploits in results. For example, for CVE-2019-13234. Cool, right? 😏
GitHub made their own CVE-based Vulnerability Database with good mapping to commits and affected packages. The only thing is missing there - EXPLOITs.
And now the #Vulners Team makes it even better! Now you can search for GitHub advisories at Vulners and see the links to exploits in results. For example, for CVE-2019-13234. Cool, right? 😏
Forwarded from Vulnerability Management and more
Hello everyone! In this episode, I would like to talk about #Github and how to remove sensitive information that was accidentally uploaded there.
This is a fairly common problem. When publishing the project code on Github, developers forget to remove credentials: logins, passwords, tokens. What to do if this becomes known? Well, of course, these credentials must be urgently changed.
What was publicly available on the Internet cannot be completely removed. This data is indexed and copied by some systems. But wiping it from github.com is real.
Why is it not enough to just delete the file in the Github repository? The problem is that the history of changes for the file will remain and everything will be visible there. Surprisingly, there is still no tool in the Github web interface to remove the history for a file. You have to use third-party utilities, one of them is git-filter-repo.
Video: https://youtu.be/FugrD23ix50
Video2 (for Russia): https://vk.com/video-149273431_456239077
Blogpost: https://avleonov.com/2022/03/27/how-to-remove-sensitive-information-from-github-repository/
This is a fairly common problem. When publishing the project code on Github, developers forget to remove credentials: logins, passwords, tokens. What to do if this becomes known? Well, of course, these credentials must be urgently changed.
What was publicly available on the Internet cannot be completely removed. This data is indexed and copied by some systems. But wiping it from github.com is real.
Why is it not enough to just delete the file in the Github repository? The problem is that the history of changes for the file will remain and everything will be visible there. Surprisingly, there is still no tool in the Github web interface to remove the history for a file. You have to use third-party utilities, one of them is git-filter-repo.
Video: https://youtu.be/FugrD23ix50
Video2 (for Russia): https://vk.com/video-149273431_456239077
Blogpost: https://avleonov.com/2022/03/27/how-to-remove-sensitive-information-from-github-repository/
YouTube
How to remove sensitive information from a Github repository
Hello everyone! In this episode, I would like to talk about Github and how to remove sensitive information that was accidentally uploaded there.
This is a fairly common problem. When publishing the project code on Github, developers forget to remove credentials:…
This is a fairly common problem. When publishing the project code on Github, developers forget to remove credentials:…