OWASP SafeNuGet - Revision history

Eoftedal at 20:50, 23 June 2013

2013-06-23T20:50:34Z

Eoftedal at 20:48, 23 June 2013

2013-06-23T20:48:31Z

Eoftedal at 20:48, 23 June 2013

2013-06-23T20:48:15Z

Eoftedal: initial version

2013-06-23T17:26:01Z

initial version

New page

The OWASP Top 10 2013 contains a new entry: [https://www.owasp.org/index.php/Top_10_2013-A9-Using_Components_with_Known_Vulnerabilities A9 - Using Components with Known Vulnerabilities]. Dependency-check can currently be used to scan Java applications (and their dependent libraries) to identify any known vulnerable components.

The problem with using known vulnerable components was described very well in a paper by Jeff Williams and Arshan Dabirsiaghi titled, "[https://www.aspectsecurity.com/uploads/downloads/2012/03/Aspect-Security-The-Unfortunate-Reality-of-Insecure-Libraries.pdf The Unfortunate Reality of Insecure Libraries]". The gist of the paper is that we as a development community include third party libraries in our applications that contain well known published vulnerabilities (such as those at the [http://web.nvd.nist.gov/view/vuln/search National Vulnerability Database]).

OWASP SafeNuGet is an MSBuild task which will warn developers if they are using NuGet packages with known vulnerabilities.

More information about dependency-check can be found on the [https://github.com/owasp/SafeNuGet Github SafeNuGet site].

=Project About=
{{:Projects/OWASP_SafeNuGet}}

[[Category:OWASP Project]]

← Older revision		Revision as of 20:50, 23 June 2013
Line 6:		Line 6:

	More information about SafeNuGet can be found on the [https://github.com/owasp/SafeNuGet Github SafeNuGet site].		More information about SafeNuGet can be found on the [https://github.com/owasp/SafeNuGet Github SafeNuGet site].
		+
		+	For a similar tool for java see [[OWASP_Dependency_Check]]

	=Project About=		=Project About=

← Older revision		Revision as of 20:48, 23 June 2013
Line 1:		Line 1:
−	The OWASP Top 10 2013 contains a new entry: [https://www.owasp.org/index.php/Top_10_2013-A9-Using_Components_with_Known_Vulnerabilities A9 - Using Components with Known Vulnerabilities]. ~~Dependency-check~~ can currently be used to scan ~~Java~~ applications ~~(and their dependent libraries)~~ to identify any known vulnerable components.	+	The OWASP Top 10 2013 contains a new entry: [https://www.owasp.org/index.php/Top_10_2013-A9-Using_Components_with_Known_Vulnerabilities A9 - Using Components with Known Vulnerabilities]. SafeNuGet can currently be used to scan .NET applications to identify any known vulnerable components.

	The problem with using known vulnerable components was described very well in a paper by Jeff Williams and Arshan Dabirsiaghi titled, "[https://www.aspectsecurity.com/uploads/downloads/2012/03/Aspect-Security-The-Unfortunate-Reality-of-Insecure-Libraries.pdf The Unfortunate Reality of Insecure Libraries]". The gist of the paper is that we as a development community include third party libraries in our applications that contain well known published vulnerabilities (such as those at the [http://web.nvd.nist.gov/view/vuln/search National Vulnerability Database]).		The problem with using known vulnerable components was described very well in a paper by Jeff Williams and Arshan Dabirsiaghi titled, "[https://www.aspectsecurity.com/uploads/downloads/2012/03/Aspect-Security-The-Unfortunate-Reality-of-Insecure-Libraries.pdf The Unfortunate Reality of Insecure Libraries]". The gist of the paper is that we as a development community include third party libraries in our applications that contain well known published vulnerabilities (such as those at the [http://web.nvd.nist.gov/view/vuln/search National Vulnerability Database]).

@@ Line 5: / Line 5: @@
 OWASP SafeNuGet is an MSBuild task which will warn developers if they are using NuGet packages with known vulnerabilities.
-More information about dependency-check can be found on the [https://github.com/owasp/SafeNuGet Github SafeNuGet site].
+More information about SafeNuGet can be found on the [https://github.com/owasp/SafeNuGet Github SafeNuGet site].
 =Project About=