Skip to main content

Browsing security advisories in the GitHub Advisory Database

You can browse the GitHub Advisory Database to find advisories for security risks in open source projects that are hosted on GitHub.

About the GitHub Advisory Database

The GitHub Advisory Database contains a list of known security vulnerabilities and malware, grouped in two categories: GitHub-reviewed advisories and unreviewed advisories.

Agregamos asesorías a la GitHub Advisory Database desde los siguientes orígenes:

About types of security advisories

Nota: Las asesorías relacionadas con malware actualmente se encuentran en versión beta y están sujetas a cambios.

Each advisory in the GitHub Advisory Database is for a vulnerability in open source projects or for malicious open source software.

Una vulnerabilidad es un problema en el código de un proyecto que se puede aprovechar para dañar la confidencialidad, la integridad o la disponibilidad del proyecto o de otros proyectos que usan su código. Las vulnerabilidades varían en tipo, severidad y método de ataque. Vulnerabilities in code are usually introduced by accident and fixed soon after they are discovered. You should update your code to use the fixed version of the dependency as soon as it is available.

In contrast, malicious software, or malware, is code that is intentionally designed to perform unwanted or harmful functions. The malware may target hardware, software, confidential data, or users of any application that uses the malware. You need to remove the malware from your project and find an alternative, more secure replacement for the dependency.

GitHub-reviewed advisories

GitHub-reviewed advisories are security vulnerabilities or malware that have been mapped to packages in ecosystems we support. We carefully review each advisory for validity and ensure that they have a full description, and contain both ecosystem and package information.

Generally, we name our supported ecosystems after the software programming language's associated package registry. We review advisories if they are for a vulnerability in a package that comes from a supported registry.

If you have a suggestion for a new ecosystem we should support, please open an issue for discussion.

If you enable Dependabot alerts for your repositories, you are automatically notified when a new GitHub-reviewed advisory reports a vulnerability or malware for a package you depend on. For more information, see "About Dependabot alerts."

Unreviewed advisories

Unreviewed advisories are security vulnerabilites that we publish automatically into the GitHub Advisory Database, directly from the National Vulnerability Database feed.

Dependabot doesn't create Dependabot alerts for unreviewed advisories as this type of advisory isn't checked for validity or completion.

About information in security advisories

Each security advisory contains information about the vulnerability or malware, which may include the description, severity, affected package, package ecosystem, affected versions and patched versions, impact, and optional information such as references, workarounds, and credits. In addition, advisories from the National Vulnerability Database list contain a link to the CVE record, where you can read more details about the vulnerability, its CVSS scores, and its qualitative severity level. For more information, see the "National Vulnerability Database" from the National Institute of Standards and Technology.

The severity level is one of four possible levels defined in the "Common Vulnerability Scoring System (CVSS), Section 5."

  • Low
  • Medium/Moderate
  • High
  • Critical

The GitHub Advisory Database uses the CVSS levels described above. If GitHub obtains a CVE, the GitHub Advisory Database uses CVSS version 3.1. If the CVE is imported, the GitHub Advisory Database supports both CVSS versions 3.0 and 3.1.

También puede unir GitHub Security Lab para examinar temas relacionados con la seguridad y colaborar en herramientas y proyectos de seguridad.

Accessing an advisory in the GitHub Advisory Database

  1. Navigate to https://github.com/advisories.

  2. Optionally, to filter the list, use any of the drop-down menus. Dropdown filters

    Tip: You can use the sidebar on the left to explore GitHub-reviewed and unreviewed advisories separately.

  3. Click an advisory to view details. By default, you will see GitHub-reviewed advisories for security vulnerabilities. To show malware advisories, use type:malware in the search bar.

The database is also accessible using the GraphQL API. By default, queries will return GitHub-reviewed advisories for security vulnerabilities unless you specify type:malware. For more information, see the "security_advisory webhook event."

Editing an advisory in the GitHub Advisory Database

You can suggest improvements to any advisory in the GitHub Advisory Database. For more information, see "Editing security advisories in the GitHub Advisory Database."

Searching the GitHub Advisory Database

You can search the database, and use qualifiers to narrow your search. For example, you can search for advisories created on a certain date, in a specific ecosystem, or in a particular library.

El formato de fecha debe seguir el estándar ISO8601, que es YYYY-MM-DD (año-mes-día). También puede agregar información de tiempo opcional THH:MM:SS+00:00 después de la fecha, para buscar por hora, minuto y segundo. Esto es, T, seguido de HH:MM:SS (hora-minutos-segundos) y una diferencia horaria con UTC (+00:00).

Cuando buscas una fecha, puedes utilizar los calificadores de mayor qué, menor qué y rango para filtrar aún más los resultados. Para más información, vea "Descripción de la sintaxis de búsqueda".

QualifierExample
type:reviewedtype:reviewed will show GitHub-reviewed advisories for security vulnerabilities.
type:malwaretype:malware will show GitHub-reviewed advisories for malware.
type:unreviewedtype:unreviewed will show unreviewed advisories.
GHSA-IDGHSA-49wp-qq6x-g2rf will show the advisory with this GitHub Advisory Database ID.
CVE-IDCVE-2020-28482 will show the advisory with this CVE ID number.
ecosystem:ECOSYSTEMecosystem:npm will show only advisories affecting NPM packages.
severity:LEVELseverity:high will show only advisories with a high severity level.
affects:LIBRARYaffects:lodash will show only advisories affecting the lodash library.
cwe:IDcwe:352 will show only advisories with this CWE number.
credit:USERNAMEcredit:octocat will show only advisories credited to the "octocat" user account.
sort:created-ascsort:created-asc will sort by the oldest advisories first.
sort:created-descsort:created-desc will sort by the newest advisories first.
sort:updated-ascsort:updated-asc will sort by the least recently updated first.
sort:updated-descsort:updated-desc will sort by the most recently updated first.
is:withdrawnis:withdrawn will show only advisories that have been withdrawn.
created:YYYY-MM-DDcreated:2021-01-13 will show only advisories created on this date.
updated:YYYY-MM-DDupdated:2021-01-13 will show only advisories updated on this date.

Viewing your vulnerable repositories

For any GitHub-reviewed advisory in the GitHub Advisory Database, you can see which of your repositories are affected by that security vulnerability or malware. To see a vulnerable repository, you must have access to Dependabot alerts for that repository. For more information, see "About Dependabot alerts."

  1. Navigate to https://github.com/advisories.
  2. Click an advisory.
  3. At the top of the advisory page, click Dependabot alerts. Dependabot alerts
  4. Optionally, to filter the list, use the search bar or the drop-down menus. The "Organization" drop-down menu allows you to filter the Dependabot alerts per owner (organization or user). Search bar and drop-down menus to filter alerts
  5. For more details about the advisory, and for advice on how to fix the vulnerable repository, click the repository name.

Accessing the local advisory database on your GitHub Enterprise Server instance

If your site administrator has enabled GitHub Connect for your GitHub Enterprise Server instance, you can also browse reviewed advisories locally. For more information, see "About GitHub Connect".

You can use your local advisory database to check whether a specific security vulnerability is included, and therefore whether you'd get alerts for vulnerable dependencies. You can also view any vulnerable repositories.

  1. Navigate to https://HOSTNAME/advisories.

  2. Optionally, to filter the list, use any of the drop-down menus. Dropdown filters

    Note: Only reviewed advisories will be listed. Unreviewed advisories can be viewed in the GitHub Advisory Database on GitHub.com. For more information, see "Accessing an advisory in the GitHub Advisory Database".

  3. Click an advisory to view details. By default, you will see GitHub-reviewed advisories for security vulnerabilities. To show malware advisories, use type:malware in the search bar.

You can also suggest improvements to any advisory directly from your local advisory database. For more information, see "Editing advisories from your GitHub Enterprise Server instance".

Viewing vulnerable repositories for your GitHub Enterprise Server instance

Los propietarios de empresa deben habilitar Dependabot alerts para your GitHub Enterprise Server instance antes de poder usar esta característica. Para obtener más información, consulte "Habilitación de Dependabot para la empresa".

In the local advisory database, you can see which repositories are affected by each security vulnerability or malware. To see a vulnerable repository, you must have access to Dependabot alerts for that repository. For more information, see "About Dependabot alerts."

  1. Navigate to https://HOSTNAME/advisories.
  2. Click an advisory.
  3. At the top of the advisory page, click Dependabot alerts. Dependabot alerts
  4. Optionally, to filter the list, use the search bar or the drop-down menus. The "Organization" drop-down menu allows you to filter the Dependabot alerts per owner (organization or user). Search bar and drop-down menus to filter alerts
  5. For more details about the advisory, and for advice on how to fix the vulnerable repository, click the repository name.

Further reading