advisory-database - Security vulnerability database inclusive of CVEs

项目说明

GitHub Ad Database

A database of CVEs and GitHub-originated security ad affecting the open source world.

The database is free and open source and is a tool for and by the community.

Submit pull requests to help improve our database of software information for all.

Goals

* To provide a free and open-source repository of security ad.
* To enable our community to crowd-source their knowledge about these ad.
* To surface in an industry-accepted formatting standard for machine interoperability.

Features

All ad acknowledged by GitHub are stored as indi files in this repository. They are formatted in the Open Source (OS.

You can submit a pull request to this database (see, Contributions) to change or update the information in each ad.

Pull requests will be re and either merged or closed by our internal security ad curation team. If the ad originated from a GitHub repository, we will also the original publisher for optional commentary.

Sources

We add ad to the GitHub Ad Database from the following sources:

If you know of another database we should be importing ad from, tell us about it by opening an issue in this repository.

Contributions

There are two ways to contribute to the information provided in this repository.

From any indi ad on github.com/ad, click Suggest impro for this (shown below) to open an "Impro ad" form. Edit the information in the form and click Submit impro to open a pull request with your proposed changes.

!Screen shot showing the "Suggest impro for this " link in the right sidebar

Alternatively, you can submit a pull request directly against a file in this repository. To do so, follow the contribution guidelines.

References

Ad references are intended to be supplemental, relevant information for the reader. We aim to include primary source references provided by the CVE or GHSA authors, supplement with relevant code or documentation when applicable, and focus on concision and relevance for any additional references. We generally avoid including secondary source write ups on ad unless they are provided by the upstream source.

Fix commits

Ad are about specific build artifacts, and not about the project more generally. A reference to the commit that fixes a gi is helpful for downstream readers to determine impact, and we welcome contributions adding these details when missing. If the ad already includes the relevant fix commit(s), we do not accept contributions that are duplicative, as adding irrelevant duplicate content creates an unnecessary burden on the reader of an ad.

Supported ecosystems

Unfortunately, we cannot accept community contributions to ad outside of our supported ecosystems. Our curation team reviews each community contribution thoroughly and needs to be able to assess each change.

Generally speaking, our ecosystems are the namespace used by a package registry. As such they’re focused on packages within the registry which tend to be dependencies used in software de.

Our supported ecosystems are:

If you have a suggestion for a new ecosystem we should support, please open an issue for discussion.

License

This project is licensed under the terms of the CC-BY 4.0 open source license. Please see our documentation for the full terms.

GHSA IDs

Each security ad, regardless of its type, has a unique identifier referred to as a GHSA ID.

A GHSA-ID qualifier is assigned when a new ad is created on GitHub or added to the GitHub Ad Database from any of the supported sources.

The syntax of GHSA IDs follows this format: GHSA-xxxx-xxxx-xxxx where

* x is a letter or a number from the following set: 23456789cfghjmpqrvwx.
* Outside the GHSA portion of the name:
* The numbers and letters are randomly assigned.
* All letters are lowercase.

You can a GHSA ID using a regular expression:
/GHSA(-[23456789cfghjmpqrvwx]{4}){3}/

database_specific

The OS supports several database_specific JSON object fields that are used to add context to other parts of the OS, namely an affected package, a package's affected ranges, and the as a whole. Per the spec, these fields are used for holding additional information about the package, range, or "as defined by the database from which the record was obtained." It additionally stipulates that the meaning and format of these custom "is entirely defined by the database [of record]" and outside of the scope of the OS itself.

For its purposes, GitHub uses a number of database_specific in its OS. They are used primarily in support of Community Contributions and are intended for internal use only unless otherwise specified. These and their format are subject to change without notice. Consuming systems should not rely on them for processing information.

| Scope | Field | Purpose |
|---|---|---|
| | se | The OS supports quantitati scores such as CVSS. GitHub additionally assigns each a non-quantitati se value. |
| | cwe_ids | GitHub assigns each at least one Common Weakness Enumeration (CWE) as part of its curation process. These IDs map directly to CWE IDs tracked in the CWE Database. |
| | github_re | Whether a has been re by one of GitHub's Security Curators. |
| | github_re | The timestamp of the last review by a GitHub Security Curator. |
| range | last_known_affected_ | The OS does not ha support for all of the potential ways GitHub represents ranges internally. It is used to track range information that is not representable in OS, or that GitHub needs to be able to track separately from the OS. This field may appear in addition to or in place of OS range events. See this comment a technical explanation. |

FAQ

Who reviews the pull requests?

Our internal Security Ad Curation team reviews the pull requests. They make the ultimate decision to merge or close. If the ad originated from a GitHub repository, we will also the original publisher for optional commentary.

Why is the base branch changed on a PR?

This repository is a mirror of our ad database. All contributions to this repository are merged into the main branch via our primary data source to preserve data integrity.

We automatically create a staging branch for each PR to preserve the GitHub workflow you're used to. When a contribution is accepted from a PR in this repository, the changes are merged into the staging branch and then pushed to the primary data source to be merged into main by a separate process, at which point the staging branch is deleted.

Will the structure of the database change?

Here at GitHub, we ship to learn! As usage patterns emerge, we may iterate on how we organize this database and potentially make backwards-incompatible changes to it.

Where can I get more information about GitHub ad?

Information about creating a repository security ad can be found here, and information about browsing security ad in the GitHub Ad Database can be found here.

项目信息

开发语言：未知

Star 数：2485

技术要点

该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。