TMA-GITLAB-3.2.4
Ensure packages are automatically scanned for ownership change
Description
Scan every package automatically for ownership change. A change in package ownership is not a regular action. In some cases it can lead to a massive problem (for example, the "event-stream" incident). Open-source contributors are not always trusted, since by its very nature everyone can contribute. This means malicious actors can become contributors as well. Package maintainers might transfer their ownership to someone they do not know if maintaining the package is too much for them, in some cases without the other user's knowledge. This has led to known security breaches in the past. It is best to be aware of such activity as soon as it happens and to carefully examine the situation before continuing using the package in order to determine its safety.
Méthode de vérification
Méthode d'audit: Revue manuelle
Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.
Ensure automatic scanning of packages for ownership change is set.
Méthode de correction
Méthode de correction: Recommandation ou correctif d'infrastructure
Set automatic scanning of packages for ownership change.
Propriétés
- Systèmes d'exploitation
- Tous
- Étiquettes
- devsecopsgitlab
- Référence
- CIS GitLab Benchmark v1.0.1 - 3.2.4 Ensure packages are automatically scanned for ownership change