OPENSSL GITHUB HOW TO

Skip to the section youвЂ™re interested in! The second perspective is that of a security researcher, for whom IвЂ™ll explain the details and impact of the vulnerabilities.

OPENSSL GITHUB HOW TO

The first perspective is that of a developer, for whom IвЂ™ll demonstrate how to use CodeQL to find variants of bugs, patch them, and make sure they arenвЂ™t introduced again. You can read this post from two different perspectives. The first is detailed in advisory GHSL-2020-056, and the second is my main topic here. In the course of my work as a GitHub security researcher, I found two security bugs in the OpenSSL library. This post focuses on OpenSSL, a library thatвЂ™s a core dependency for the cryptographic needs of a lot of software, particularly when it comes to SSL/TLS support. Focusing on library code is a great way to optimize for limited security research resources.

This is why working to improve the security of widely used libraries has a force multiplication effect that can positively impact every single project that depends on the library. GitHubвЂ™s State of the Octoverse reports that up to 94% of projects rely on open source components, with nearly 700 dependencies per repository.

Securing a single project is already a difficult task, but trying to also secure the libraries that a project depends on is beyond the resources of most development teams and grows exponentially in size and complexity as your dependencies in turn have their own dependencies. Code review and good software engineering practices face this problem on a daily basis.

The moment a library dependency is introduced, youвЂ™re adopting other peopleвЂ™s code and any bugs that come with it. Software security doesnвЂ™t end at the boundaries of your own code.

Openssl github