ruby-advisory-db

Note that it won't yet detect this specific vulnerability: https://github.com/rubysec/ruby-advisory-db/pull/386

For extra info, bundler-audit relies on https://github.com/rubysec/ruby-advisory-db

I'd like to know if there is something similar for Python, or something like https://github.com/rubysec/ruby-advisory-db for Python.

You can run this check yourself using the bundle-audit tool. It uses the list of vulnerabilities from ruby-advisory-db. Checking the git history, I see that phillmv is a contributor to ruby-advisory-db. https://github.com/rubysec/bundler-audit https://github.com/rubysec/ruby-advisory-db

1. They all do a great job! But there's this last mile problem with managing the information they do put out. If you can handle the downtime, unattended-upgrades will work just dandy. If your postgres restarting in the middle of the night gives you pause, our service can help you choose how to roll out your security upgrades. 2. We cover app dependencies as well! For now just Ruby, but others as well pretty soon. I'm one of the maintainers of the Ruby Advisory Database https://github.com/rubysec/ruby-advisory-db/ - and we know all about the effort involved.

Hey! I'm one of the maintainers behind the Ruby advisory database: https://github.com/rubysec/ruby-advisory-db We're trying to build a common database for people building these tools; at the moment, trawling through CVE disclosures and various mailing lists is a largely manual process that we can reap economies of scale by pooling our efforts together. It's free and volunteer run. I would like to encourage you and anyone else reading this who is interested in bolstering the security ecosystem to consider using and contributing to the advisory database. It's the database that powers http://github.com/rubysec/bundler-audit and (disclaimer: I made this) https://gemcanary.com and the more people contributing the more we can all benefit from improving the ways we can notify end users of their vulnerable dependencies. Thanks,

So, all software has two problems. First one is finding, reporting and getting vulnerabilities. Most people don't perform security audits. Most vendors take forever to reply back to security reports. Infuriatingly, many vendors will roll security fixes into the next major release instead of backporting patches and minor versions. The second one is about finding out about disclosed and patched vulnerabilities. Outside of larger institutions where you have someone whose job it is to worry over configuration management and subscribe to every mailing list, the ecosystem for disseminating this information is broken. That's why we've started the https://github.com/rubysec/ruby-advisory-db, at least for the Ruby ecosystem.

Hi, I'm with http://rubysec.github.com/ We maintain a freely available advisory database https://github.com/rubysec/ruby-advisory-db/ designed to be easily machine readable. We also maintain a free ruby-wide security announcement mailing list: https://groups.google.com/forum/?fromgroups#!forum/rubysec-a... The rubysec-advisory-db is meant to power discovery tools such as https://github.com/postmodern/bundler-audit (from which it was originally extracted) or https://gemcanary.com (it bears mentioning that my company made it). I'm pretty sure it will be used in codeclimate's upcoming security monitor https://codeclimate.com/security-monitor given that Bryan is a regular contributor. If you're interested in security, please consider checking us out. Most of rubysec is composed of security professionals, and we're all interested in improving

We're actually collaborating with him on the advisory database that gemcanary and bundler-audit both use. It's free and open for anyone to use. Check it out: https://github.com/rubysec/ruby-advisory-db

(I'm the other person responsible for gemcanary) Having a record of all the security vulnerabilities that affect the Ruby community is important. To that end, we help maintain https://github.com/rubysec/ruby-advisory-db/ which is free for anyone to use or contribute to.

So, we're only interested in sending security notices. We don't care about being notified about every dependency out there. As a result, the hard part is collecting info on vulnerable dependencies. We solved this problem for Ruby by… co-maintaining an open source database https://github.com/rubysec/ruby-advisory-db/ – which everyone is free to use. We don't have the resources to do this for every community :).

Also see related projects: - https://github.com/rubysec/ruby-advisory-db - https://github.com/postmodern/bundler-audit