Fern Pattern Scanner

Fern 模式扫描器 欢迎使用 Fern 的模式扫描器。该扫描器会扫描你建议的文件，并使用 正则表达式 查找 rules/rules.yaml 中规定的任何模式。然后生成一份包含所有发现的报告。本项目用于展示如何将自定义 安全扫描器集成到 GitLab，并用于填充 流水线安全选项卡、漏洞报告 和 合并请求小部件 注意 ：访问漏洞报告需要 GitLab Ultimate 订阅 将扫描器添加到你的 GitLab CI/CD 流水线 你可以通过将以下内容添加到你的 .gitlab-ci.yml 来激活此安全扫描器： include: - remote:...

GitLeaks

GitLeaks GitLab CI コンポーネント Gitleaks 用の GitLab CI コンポーネント - パスワード、API キー、トークンといったハードコードされた秘密情報を git リポジトリで検出・防止する SAST ツールです。 機能 シークレット検出 : リポジトリをスキャンし、ハードコードされた秘密情報や機密情報を検出します。 包括的なルール : さまざまな種類の秘密情報を検出するための豊富なビルトインルール カスタム設定 : ローカルおよびリモート設定ファイルのサポート 複数の出力形式 : JSON、SARIF、その他のレポート形式をサポート 柔軟な引数 :...

trivy

Trivy GitLab CI コンポーネント Trivy（オールインワンのセキュリティスキャナー：コンテナイメージ、ファイルシステム、リポジトリ、Kubernetesクラスター、SBOM、ライセンスコンプライアンスをカバー）のためのGitLab CIコンポーネントです。これらのテンプレートをパイプラインに直接組み込むことで、繰り返し可能なスキャン、GitLabネイティブのレポート、スクリプトをほとんど書かずにポータブルなアーティファクトを取得できます。 機能 完全なサーフェスカバレッジ...

GitLeaks

GitLeaks コンテナイメージ ローカルワークフローやパイプラインでの機密情報スキャンに特化した gitleaks ビルドです。 特徴 タグ付けされた上流ソースから gitleaks をビルドし、再現可能なバイナリのために Go ツールチェーンを固定しています。 GitLab CI コンポーネント: niclas-zone/ci/gitleaks 使い方 イメージのプル podman pull registry.gitlab.com/niclas-zone/ctr/gitleaks:latest スキャンの実行 podman run --rm \ -v $pwd:/repo \ -w...

Dependency Scanning v2.1.1

Component for Dependency and License Scanning This component generates a CycloneDX Software Bill of Materials, which is used by GitLab to identify a project's dependencies, and their licenses. This CycloneDX Software Bill of Materials is compatible with the GitLab taxonomy. Additionally, this...

CVE-2025-1677

A Denial of Service DoS issue has been discovered in GitLab CE/EE affecting all up to 17.8.7, 17.9 prior to 17.9.6 and 17.10 prior to 17.10.4 A denial of service could occur upon injecting oversized payloads into CI pipeline exports...

EUVD-2019-15045

Malware in sbrugna...

EUVD-2020-5548

Malware in sbrugna...

CVE-2021-39935

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API...

CVE-2019-5463

An authorization issue was discovered in the GitLab CE/EE CI badge images endpoint which could result in disclosure of the build status. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6...

CVE-2019-13003

An issue was discovered in GitLab Community and Enterprise Edition before 12.0.3. One of the parsers used by Gilab CI was vulnerable to a resource exhaustion attack. It allows Uncontrolled Resource Consumption...

kernel:4.18.0 security update

4.18.0-553.30.110.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

kernel security update

5.14.0-503.14.15.OL9 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

Oracle Linux 9 : kernel (ELSA-2024-3306)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-3306 advisory. - netfilter: nftables: disallow anonymous set with timeout flag Phil Sutter RHEL-32971 RHEL-30082 CVE-2024-26642 - netfilter: nftables: mark set as dea...

kernel security, bug fix, and enhancement update

4.18.0-553.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and shim-x...

UBUNTU-CVE-2023-3909

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.3 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. A Regular Expression Denial of Service was possible by adding a large string in timeout input in...

Authorization

An improper authorization issue in GitLab CE/EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to read variables set directly in a GitLab CI/CD configuration file they don't have access to...

CVE-2022-3793: Undefined Security Weakness

An improper authorization issue in GitLab CE/EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to read variables set directly in a GitLab CI/CD configuration file they don't have access to...

`rustdecimal` is a malicious crate

The Rust Security Response WG and the crates.io team were notified1 on 2022-05-02 of the existence of the malicious crate rustdecimal, which contained malware. The crate name was intentionally similar to the name of the popular rustdecimal2 crate, hoping that potential victims would misspell its...

MAL-2022-1 Malicious code in rustdecimal (crates.io)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e33f42f05c60c6d9f9297bae15a43d6c445e2ad0fd67fa4ef144e5cc79d09c7 The Rust Security Response WG and the crates.io team were notified1 on 2022-05-02 of the existence of the malicious crate rustdecimal, which contained...