Fern Pattern Scanner

Fern Pattern Scanner Fern のパターンスキャナーへようこそ。このスキャナーは、指定されたファイルをスキャンし、rules/rules.yaml 内で定義されたパターンを regex を使用して検出します。その後、すべての検出結果を含むレポートが生成されます。このプロジェクトは、カスタムのセキュリティスキャナーを GitLab に統合する方法を示し、パイプラインセキュリティタブ、脆弱性レポート、マージリクエストウィジェット に入力するために使用できることを紹介するためのものです。 注 : 脆弱性レポートにアクセスするには、GitLab Ultimate...

GitLeaks

GitLeaks GitLab CI 컴포넌트 GitLab CI용 Gitleaks 컴포넌트입니다 - git 저장소에서 비밀번호, API 키, 토큰과 같은 하드코딩된 시크릿을 탐지하고 방지하는 SAST 도구입니다. 기능 시크릿 탐지 : 저장소에서 하드코딩된 시크릿 및 민감 정보를 스캔합니다 포괄적인 규칙 : 다양한 유형의 시크릿을 탐지하기 위한 광범위한 내장 규칙 집합 사용자 정의 구성 : 로컬 및 원격 구성 파일 지원 다중 출력 형식 : JSON, SARIF 및 기타 보고서 형식 지원 유연한 인수 : Gitleaks에 추가 플래그...

trivy

Trivy GitLab CI 컴포넌트 GitLab CI를 위한 Trivy 컴포넌트입니다. Trivy는 컨테이너 이미지, 파일시스템, 리포지토리, Kubernetes 클러스터, SBOM, 라이선스 규정 준수를 포괄하는 올인원 보안 스캐너입니다. 이 템플릿들을 파이프라인에 직접 연결하면 거의 셸 스크립팅 없이 반복 가능한 스캔, GitLab 네이티브 보고서 및 이식 가능한 아티팩트를 얻을 수 있습니다. 기능 전체 표면 커버리지 : 컨테이너, 파일시스템, 루트 파일시스템, Git 리포지토리, VM, SBOM, Kubernetes...

GitLeaks

GitLeaks 컨테이너 이미지 로컬 워크플로 및 파이프라인에서 비밀 스캐닝을 위한 맞춤형 gitleaks 빌드입니다. 기능 재현 가능한 바이너리를 위해 고정된 Go 툴체인과 함께 태그된 업스트림 소스에서 gitleaks를 빌드합니다. niclas-zone/ci/gitleaks의 GitLab CI 컴포넌트. 사용법 이미지 가져오기 root@kitploit: podman pull registry.gitlab.com/niclas-zone/ctr/gitleaks:latest 스캔 실행 root@kitploit: podman run...

CVE-2025-1677

A Denial of Service DoS issue has been discovered in GitLab CE/EE affecting all up to 17.8.7, 17.9 prior to 17.9.6 and 17.10 prior to 17.10.4 A denial of service could occur upon injecting oversized payloads into CI pipeline exports...

EUVD-2019-15045

Malware in sbrugna...

EUVD-2020-5548

Malware in sbrugna...

CVE-2021-39935

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API...

CVE-2019-5463

An authorization issue was discovered in the GitLab CE/EE CI badge images endpoint which could result in disclosure of the build status. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6...

CVE-2019-13003

An issue was discovered in GitLab Community and Enterprise Edition before 12.0.3. One of the parsers used by Gilab CI was vulnerable to a resource exhaustion attack. It allows Uncontrolled Resource Consumption...

kernel:4.18.0 security update

4.18.0-553.30.110.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

kernel security update

5.14.0-503.14.15.OL9 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

Oracle Linux 9 : kernel (ELSA-2024-3306)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-3306 advisory. - netfilter: nftables: disallow anonymous set with timeout flag Phil Sutter RHEL-32971 RHEL-30082 CVE-2024-26642 - netfilter: nftables: mark set as dea...

kernel security, bug fix, and enhancement update

4.18.0-553.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and shim-x...

UBUNTU-CVE-2023-3909

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.3 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. A Regular Expression Denial of Service was possible by adding a large string in timeout input in...

Authorization

An improper authorization issue in GitLab CE/EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to read variables set directly in a GitLab CI/CD configuration file they don't have access to...

`rustdecimal` is a malicious crate

The Rust Security Response WG and the crates.io team were notified1 on 2022-05-02 of the existence of the malicious crate rustdecimal, which contained malware. The crate name was intentionally similar to the name of the popular rustdecimal2 crate, hoping that potential victims would misspell its...

MAL-2022-1 Malicious code in rustdecimal (crates.io)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e33f42f05c60c6d9f9297bae15a43d6c445e2ad0fd67fa4ef144e5cc79d09c7 The Rust Security Response WG and the crates.io team were notified1 on 2022-05-02 of the existence of the malicious crate rustdecimal, which contained...

GHSA-7PWQ-F4PQ-78GM `rustdecimal` is a malicious crate

The Rust Security Response WG and the crates.io team were notified1 on 2022-05-02 of the existence of the malicious crate rustdecimal, which contained malware. The crate name was intentionally similar to the name of the popular rustdecimal2 crate, hoping that potential victims would misspell its...

RUSTSEC-2022-0042 malicious crate `rustdecimal`

The Rust Security Response WG and the crates.io team were notified1 on 2022-05-02 of the existence of the malicious crate rustdecimal, which contained malware. The crate name was intentionally similar to the name of the popular rustdecimal2 crate, hoping that potential victims would misspell its...