What is the GitHub 'advisory database' and how does it contribute to Dependabot alerts?
Select an answer to reveal the explanation.
Short Explanation and Infographic
The GitHub Advisory Database is GitHub's vulnerability intelligence feed. It aggregates CVEs from NVD, repository security advisories, and community contributions. When Dependabot sees your package.json dependencies, it cross-references them against this database to generate alerts.
Full explanation below image
Full Explanation
The GitHub Advisory Database (advisories.github.com) is GitHub's comprehensive database of known software security vulnerabilities. It includes: (1) CVEs from the National Vulnerability Database (NVD). (2) Repository security advisories published by maintainers. (3) Community-reviewed and curated vulnerability data. (4) GHSA (GitHub Security Advisory) identifiers for vulnerabilities. Role in Dependabot: (1) When Dependabot scans a repository's dependency manifest (package.json, Pipfile.lock, pom.xml, etc.), it queries the Advisory Database. (2) If any dependency version matches a vulnerability in the database, Dependabot creates an alert. (3) The alert includes: severity (CVSS score), affected versions, patched versions, and links to the advisory. The Advisory Database is publicly accessible and also accepts community contributions to add or improve advisory data.