randysecrist
Checking hex dependencies over time for security vulnerabilities
Quick question …
I’m working to bring elixir into a enterprise level environment and one of the requirements is to check hex dependencies over time for security vulnerabilities etc. What (if any) tools are people in the elixir community using to cover this space?
Thanks!
– Randy
Most Liked
voltone
I run a Dependency Track server, and every build automatically uploads a bill-of-materials of all Hex and NPM packages to the server. I also track OS packages for the deployment VMs in the same server. New vulnerabilities (from NVD, NPM, OSS Index) across all projects and ecosystems trigger Slack notifications. The dashboard lets me track the overall status of projects over time, audit vulnerabilities, check license usage, etc.
I wrote a blog post about it here.
voltone
The hex.audit task is useful, but not enough: it requires that the package maintainer acknowledges and fixes the reported vulnerability, and retires the affected package versions. If this doesn’t happen, the only alternative may be to switch to another package or accept the risk.
Right now my DependencyTrack server tells me that I’m affected by CVE-2019-15160, which has been an open issue in SweetXml for almost a year. Since no package has been retired, hex.audit would not make me aware of the issue, and I wouldn’t know to audit it.
cpgo
I think you are looking for GitHub - nccgroup/sobelow: Security-focused static analysis for the Phoenix Framework · GitHub
Last Post!
realcorvus
Paraxial.io now supports tracking vulnerabilities in dependencies over time, here’s the announcement blog post - https://paraxial.io/blog/vuln-scan
There’s a 30 day free trial, no credit card required. If you have any questions you can DM me on here as well.
Popular in Discussions
Other popular topics
Chat & Discussions>Discussions
Latest on Elixir Forum
Sponsor Spotlight
Enabling companies to succeed by building software people love.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #channels
- #elixirconf
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #phoenix_html
- #iex
- #blog-post
- #graphql
- #genstage
- #ai
- #websockets
- #supervisor
- #elixirconf-us
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #metaprogramming
- #security
- #hex
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Develop your skills with books, videos, and courses.
Enabling companies to succeed by building software people love.
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"