TMA-GITLAB-1.5.5

Ensure scanners are in place for open-source vulnerabilities in used packages

보통레벨 2자동gitlab

설명

Detect, prevent and monitor known open-source vulnerabilities in packages that are being used. Open-source vulnerabilities might exist before one starts to use a package, but they are also discovered over time. New attacks and vulnerabilities are announced every now and then. It is important to keep track of these and to monitor whether the dependencies used are affected by the recent vulnerability. Detecting and fixing those packages' vulnerabilities decreases the attack surface within deployed and running applications that use such packages. It prevents security flaws from reaching the production environment which could eventually lead to a security breach.

점검 방법

감사 방식: 셸 명령

shell

command -v glab >/dev/null 2>&1 || exit 1
glab auth status >/dev/null 2>&1 || exit 1
proj=$(glab repo view -F json 2>/dev/null) || exit 1
printf "%s" "$proj" | grep -q '"id":' && echo compliant || echo non-compliant

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Remediation: For every repository that is in use, set a dependency scanning tool to detect, prevent, and monitor vulnerabilities in project packages by performing the following: 1. On GitLab, navigate to the main page of the repository. 2. Configure Dependency Scanning to run on this project.

속성

운영 체제: 모두
태그: devsecopsgitlab
참고 자료: CIS GitLab Benchmark v1.0.1 - 1.5.5 Ensure scanners are in place for open-source vulnerabilities in used packages

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target gitlab --level 2