Ensure scanners are in place for open-source vulnerabilities in used packages

中级别 2自动化gitlab

说明

Detect, prevent and monitor known open-source vulnerabilities in packages that are being used. Open-source vulnerabilities might exist before one starts to use a package, but they are also discovered over time. New attacks and vulnerabilities are announced every now and then. It is important to keep track of these and to monitor whether the dependencies used are affected by the recent vulnerability. Detecting and fixing those packages' vulnerabilities decreases the attack surface within deployed and running applications that use such packages. It prevents security flaws from reaching the production environment which could eventually lead to a security breach.

检查方式

审计方法: Shell 命令

shell

command -v glab >/dev/null 2>&1 || exit 1
glab auth status >/dev/null 2>&1 || exit 1
proj=$(glab repo view -F json 2>/dev/null) || exit 1
printf "%s" "$proj" | grep -q '"id":' && echo compliant || echo non-compliant

预期输出: compliant

修复方式

修复方法: 操作指南或基础设施补丁

Remediation: For every repository that is in use, set a dependency scanning tool to detect, prevent, and monitor vulnerabilities in project packages by performing the following: 1. On GitLab, navigate to the main page of the repository. 2. Configure Dependency Scanning to run on this project.

属性

操作系统: 任意
标签: devsecopsgitlab
参考: CIS GitLab Benchmark v1.0.1 - 1.5.5 Ensure scanners are in place for open-source vulnerabilities in used packages

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target gitlab --level 2