greysteil
I’ve been looking for an open-source database of Elixir vulnerabilities, similar to The Ruby Advisory Database, The RustSec Advisory Database, or The PHP Advisory Database. As far as I can tell, there isn’t one for Elixir yet.
Assuming I’m not missing an existing one, would people be up for helping me maintain an Elixir one? I built Dependabot, and want to create a DB for vulnerabilities so that it can immediately create and tag security-related PRs in the same way it does for other languages (details here).
Where Next?
Trending in Discussions
Other Trending Topics
Latest on Elixir Forum
Sponsor Spotlight
We build reliable cloud platforms for business-critical systems.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #blog-post
- #elixir-ls
- #ai
- #elixirconf-us
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #hex
- #security
- #metaprogramming
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Master modern tools, write cleaner code, and tackle real-world challenges.
Bringing learning, work and compliance together since 1987.
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 10- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
AstonJ
Not sure if it’s the sort of thing you were thinking of, but currently there’s:
idi527
It could be a nice addition to https://hex.pm - GitHub - hexpm/hexpm: API server and website for Hex · GitHub.
Maybe you could check with them?
There are some CVEs for elixir http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=elixir (just 4 …), maybe you could use them somehow?
greysteil
Yeah, having an unencumbered database would make it easy to add a
checkcommand to hex, which would be rad.I saw Sobelow, and it looks like they’ve got some dependency vulnerability data in there in this folder. Don’t want to duplicate work, but I think it might be better to have a database of static files, like other languages do, that Sobelow could then consume?
griffinbyatt
I think a vulnerability database would be great as a standalone project. If you (or anyone) ends up creating one, I’m sure it would end up as a Sobelow integration
greysteil
Sweet! If you think this is the right approach @griffinbyatt then I think it’s definitely worth doing. I’ll create a repo under Dependabot’s account, unless you want to put it under NCC Group? It lives more naturally with you guys, if you want it. (We used you when I was at GoCardless, btw, and you were great.)
idi527
The best place for it would be probably under hexpm, I think … The vulnerability reports could also be filed through hex.pm.
I’m sure @michalmuskala, @ericmj, or @wojtekmach would know more about this.
greysteil
greysteil
OK, here’s my first version. Comments / suggestions very welcome!
https://github.com/dependabot/elixir-security-advisories
greysteil
@griffinbyatt - particularly interested in your feedback, since you found most of the vulnerabilities in there! Would the format work for Sobelow? Would you like more details stored on each vulnerability?
griffinbyatt
Glad you’re going through with this! I think the amount of detail looks great. As far as format for Sobelow, I think ultimately a web-API around this data will be most useful. I bought the elixirsecurity.com domain a while ago for pretty much exactly this use case.
Definitely happy to help out on this/support new findings. I’m fairly busy over the next couple of weeks, but feel free to tag me in an issue on Github if you want to brainstorm