GitHub discovers 4 million vulnerabilities in public code libraries

The bug hunt prompted developers and repository admins to get code fixing

GitHub has found four million security vulnerabilities in its public code repository, sparking developers to do some serious spring cleaning.

Having conducted a scan for security bugs in its JavaScript and Ruby libraries, back in November, GitHub soon dug up a mass of known vulnerabilities, spread across some 500,000 of its public code libraries.

The company quickly informed the administrators of those libraries and by 1 December 450,000 known security holes had been plugged, either by shutting down vulnerable code or launching secure versions.

And it appears this process of identifying vulnerabilities and flagging them to developers and repository admins is delivering benefits, as GitHub noted that its users are now rapidly fixing security flaws in code that's freely available for anyone to access and use to create the next popular app.

"Since [December 2017], our rate of vulnerabilities resolved in the first seven days of detection has been about 30 percent. Additionally, 15 percent of alerts are dismissed within seven days that means nearly half of all alerts are responded to within a week. Of the remaining alerts that are unaddressed or unresolved, the majority belong to repositories that have not had a contribution in the last 90 days," said GitHub.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

"In other words, for almost all repositories with recent contributions, we see maintainers patching vulnerabilities in fewer than seven days."

Vulnerabilities in open source code that's regularly accessed and integrated into the other software and firmware, can lead to security exploits spreading to all manner of apps, services and devices. So effectively policing and sanitising readily available code is one way to prevent the spread of known security flaws.

And GitHub has plans to further expand its efforts into ensuring its code repositories are better maintained.

"Security alerts are opening the door to new ways we can improve code checking and generation by combining publicly available data with GitHub's unique data set. And this is just the beginning we've got more ways to help you keep code safer on the way!" it said.

Such efforts should help forge the way to safer public code libraries, though it's always worth proceeding with caution and a focus on security vigilance when using code that's been contributed by an open community.

Featured Resources

What you need to know about migrating to SAP S/4HANA

Factors to assess how and when to begin migration

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

Testing for compliance just became easier

How you can use technology to ensure compliance in your organisation

Download now

Best practices for implementing security awareness training

How to develop a security awareness programme that will actually change behaviour

Download now
Advertisement

Most Popular

Visit/microsoft-windows/32066/what-to-do-if-youre-still-running-windows-7
Microsoft Windows

What to do if you're still running Windows 7

14 Jan 2020
Visit/operating-systems/25802/17-windows-10-problems-and-how-to-fix-them
operating systems

17 Windows 10 problems - and how to fix them

13 Jan 2020
Visit/operating-systems/microsoft-windows/354526/memes-and-viking-funerals-the-internet-reacts-to-the
Microsoft Windows

Memes and Viking funerals: The internet reacts to the death of Windows 7

14 Jan 2020
Visit/hardware/laptops/354533/dell-xps-13-new-9300-hands-on-review-chasing-perfection
Laptops

Dell XPS 13 (New 9300) hands-on review: Chasing perfection

14 Jan 2020