This repository was archived by the owner on Sep 7, 2022. It is now read-only.

Name		Name	Last commit message	Last commit date
.github		.github
logo		logo
packages		packages
spec		spec
.gitignore		.gitignore
.travis.yml		.travis.yml
Gemfile		Gemfile
Gemfile.lock		Gemfile.lock
LICENSE.txt		LICENSE.txt
README.md		README.md
Rakefile		Rakefile

Repository files navigation

Deprecation Notice

This repo was created before the GitHub Security Advisory DB supported Hex / Elixir. Now that support has been added, we've deprecated / archived this repo. The Security Advisory DB is a much more flexible solution that includes an actual API, GraphQL support, auto-ingesting from various data sources, professional curation, etc.

Elixir Advisory Database

The Elixir Advisory Database is a repository of security advisories filed against published Elixir packages.

Advisory metadata is stored in YAML format for Sobelow, Dependabot, MixAudit and other automated tools to consume.

This is also an experimental web API for the database.

Directory Structure

The database is a list of directories that match the names of Elixir libraries on [hex.pm]. Within each directory are one or more advisory files for the Elixir library.

packages/:
  plug/:
    2017-02-28.yml
    2017-02-28_2.yml

Format

Each advisory file contains the advisory information in YAML format:

---
id: 8268e120-60b4-4efb-b9ca-4e3faca0cca6
package: plug
disclosure_date: 2017-02-28
cve: 2017-1000052
link: https://elixirforum.com/t/static-and-session-security-fixes-for-plug/3913
title: |
  Null Byte Injection in Plug.Static

description: |
  Plug.Static is used for serving static assets, and is vulnerable to null
  byte injection. If file upload functionality is provided, this can allow
  users to bypass filetype restrictions.

  We recommend all applications that provide file upload functionality and
  serve those uploaded files locally with Plug.Static to upgrade immediately
  or include the fix below. If uploaded files are rather stored and served
  from S3 or any other cloud storage, you are not affected.

patched_versions:
  - ~> 1.3.2
  - ~> 1.2.3
  - ~> 1.1.7
  - ~> 1.0.4

unaffected_versions:
  - "< 1.0.0"

Schema

There is linting in place to enforce the following schema for each advisory:

Attribute	Type	Description
id	String	A version 4 UUID (use https://www.uuidgenerator.net/version4).
package	String	Name of the affected package.
disclosure_date	Date	Date the vulnerability was publicly disclosed (here or elsewhere).
cve	String/Null	(Optional) CVE assigned to the vulnerability.
link	String	Link to the original disclosure / more details.
title	String	Title of the vulnerability. This should be a (very) short description.
description	String	Description of the vulnerability.
patched_versions	Array	Array of Elixir requirement strings specifying patched versions.
unaffected_versions	Array	Array of Elixir requirement strings specifying unaffected versions.