You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Make "About global security advisories" scannable (#59651)
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com>
Copy file name to clipboardExpand all lines: content/code-security/concepts/vulnerability-reporting-and-management/about-global-security-advisories.md
+11-9Lines changed: 11 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
---
2
2
title: About global security advisories
3
3
shortTitle: Global security advisories
4
-
intro: Global security advisories live in the {% data variables.product.prodname_advisory_database %}, a collection of CVEs and {% data variables.product.company_short %}-originated advisories affecting the open source world. You can contribute to improving global security advisories.
4
+
intro: Global security advisories are CVEs and {% data variables.product.company_short %}-originated advisories affecting the open source world, located in the {% data variables.product.prodname_advisory_database %}.
5
5
versions:
6
6
fpt: '*'
7
7
ghec: '*'
@@ -19,22 +19,24 @@ redirect_from:
19
19
20
20
## About global security advisories
21
21
22
-
{% ifversion fpt or ghec %}There are two types of advisories: global security advisories and repository security advisories. For more information about repository security advisories, see [AUTOTITLE](/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories).{% endif %}
23
-
24
-
Global security advisories are grouped into these categories: {% data variables.product.company_short %}-reviewed advisories, unreviewed advisories, and malware advisories.
22
+
{% ifversion fpt or ghec %} There are two types of advisories: global security advisories and repository security advisories. {% endif %}**Global** advisories live in the [{% data variables.product.prodname_advisory_database %}](https://github.com/advisories) and are grouped into three categories:
25
23
* {% data reusables.advisory-database.github-reviewed-overview %}
26
24
* {% data reusables.advisory-database.unreviewed-overview %}
27
25
* {% data reusables.advisory-database.malware-overview %}
28
26
29
27
> [!NOTE]
30
28
> {% data variables.product.prodname_dependabot %} doesn't generate {% data variables.product.prodname_dependabot_alerts %} for unreviewed and malware advisories.
31
29
32
-
For more information about the {% data variables.product.prodname_advisory_database %}, see [AUTOTITLE](/code-security/security-advisories/working-with-global-security-advisories-from-the-github-advisory-database/about-the-github-advisory-database).
30
+
Every **repository** advisory is reviewed by the {% data variables.product.prodname_security %} curation team for consideration as a global advisory. We publish security advisories for any of the ecosystems supported by the dependency graph to the {% data variables.product.prodname_advisory_database %}.
31
+
32
+
Anyone can suggest improvements on any global security advisory. You can edit or add any detail, including additionally affected ecosystems, severity level or description of who is impacted. The {% data variables.product.prodname_security %} curation team will review the submitted improvements.
33
33
34
-
{% data reusables.security-advisory.global-advisories %}
34
+
## Next steps
35
35
36
-
Every repository advisory is reviewed by the {% data variables.product.prodname_security %} curation team for consideration as a global advisory. We publish security advisories for any of the ecosystems supported by the dependency graph to the {% data variables.product.prodname_advisory_database %} on [github.com/advisories](https://github.com/advisories).
36
+
Access advisories in the {% data variables.product.prodname_advisory_database %}. See [AUTOTITLE](/code-security/security-advisories/working-with-global-security-advisories-from-the-github-advisory-database/browsing-security-advisories-in-the-github-advisory-database).
37
37
38
-
You can access any advisory in the {% data variables.product.prodname_advisory_database %}. For more information, see [AUTOTITLE](/code-security/security-advisories/working-with-global-security-advisories-from-the-github-advisory-database/browsing-security-advisories-in-the-github-advisory-database).
38
+
{% ifversion fpt or ghec %}
39
+
## Further reading
39
40
40
-
You can suggest improvements to any advisory in the {% data variables.product.prodname_advisory_database %}. For more information, see [AUTOTITLE](/code-security/security-advisories/working-with-global-security-advisories-from-the-github-advisory-database/editing-security-advisories-in-the-github-advisory-database).
{% data variables.product.company_short %}-reviewed advisories are security vulnerabilities that have been mapped to packages in ecosystems we support. We carefully review each advisory for validity and ensure that they have a full description, and contain both ecosystem and package information.
1
+
**{% data variables.product.company_short %}-reviewed** advisories are mapped to packages in ecosystems we support. We carefully review each advisory for validity and ensure that they contain a full description and both ecosystem and package information.
Malware advisories relate to vulnerabilities caused by malware, and are security advisories that {% data variables.product.prodname_dotcom %} publishes automatically into the {% data variables.product.prodname_advisory_database %}, directly from information provided by the npm security team. Malware advisories are exclusive to the npm ecosystem. {% data variables.product.prodname_dotcom %} doesn't edit or accept community contributions on these advisories.
1
+
**Malware** advisories relate to vulnerabilities caused by malware and are exclusive to the **npm** ecosystem. We publish them automatically into the {% data variables.product.prodname_advisory_database %}, directly from information provided by the npm security team.
Unreviewed advisories are security vulnerabilities that we publish automatically into the {% data variables.product.prodname_advisory_database %}, directly from the National Vulnerability Database feed.
1
+
**Unreviewed** advisories are published automatically into the {% data variables.product.prodname_advisory_database %}, directly from the National Vulnerability Database feed.
0 commit comments