CIQ launched fully supported, upstream stable kernels for Rocky Linux via the CIQ Enterprise Linux Platform, providing enhanced performance, hardware compatibility and security.
Sonatype announced a partnership with HackerOne to create The Central Security Project (CSP).
The program brings together the ethical hacker and open source communities to streamline the process for reporting and resolving vulnerabilities discovered in libraries housed in The Central Repository, the world’s largest collection of open source components.
CSP is designed to be a centralized vulnerability reporting platform within the Java ecosystem. It will enable the community to report a vulnerability, receive quick feedback, and see all other disclosed vulnerabilities for the ecosystem, in a single platform fueled by HackerOne. Community members will also be able to track reported issues by status, keep score around quantity and severity of exploits identified, and get credit for their work. Going forward, vulnerabilities reported through the CSP will be rapidly examined by a world class team of researchers so that fixes can be quickly made available to project owners, and then responsibly disclosed to the public at large.
“When individual developers or ethical hackers try and report a new vulnerability to an open source project they often wait for months to get a response, with no guarantee they’ll ever actually receive one,” said Brian Fox, co-founder and CTO of Sonatype. “As the stewards of the Central Repository, we saw a unique opportunity to partner with HackerOne to simplify the vulnerability reporting process for all involved, and help make open source safer for the world.”
Without a standard for responsible disclosure, even those who want to disclose vulnerabilities responsibly can get frustrated with the process and turn to public lists or social media, where bad actors can easily find the details before fixes are created. Similarly, open source projects often don’t have the resources to validate that all vulnerabilities reported are real issues.
“Innovation happens faster when developers are able to share information, build on top of each others’ discoveries and learn from each other. The same is true within the security community,” said Marten Mickos, CEO of HackerOne. “The CSP brings together Sonatype’s comprehensive repository of open source components with the world’s largest community of ethical hackers. By working together, the entire open source community benefits and software becomes safer for everyone.”
How The Central Security Project Works:
- Sonatype has added “Report a vulnerability” links to every project page within the Central Repository and OSS Index.
- The links will connect individual developers and ethical hackers to the HackerOne platform where they can easily report potential exploits.
- When vulnerabilities are reported, Sonatype’s security research team will rapidly assess the report and, where appropriate, develop a fix
- HackerOne will communicate with relevant project owners and facilitate CVE assignment.
- Once the fix has been released, the vulnerability will be publicly disclosed through HackerOne’s Hacktivity page, and the person who reported it will be credited for its’ discovery and submission.
The program will initially focus on the Java ecosystem within the Central Repository, with the goal of expanding to other ecosystems over time.
Industry News
Redgate launched an enterprise version of its database monitoring tool, providing a range of new features to address the challenges of scale and complexity faced by larger organizations.
Snyk announced the expansion of its current partnership with Google Cloud to advance secure code generated by Google Cloud’s generative-AI-powered collaborator service, Gemini Code Assist.
Kong announced the commercial availability of Kong Konnect Dedicated Cloud Gateways on Amazon Web Services (AWS).
Pegasystems announced the general availability of Pega Infinity ’24.1™.
Sylabs announces the launch of a new certification focusing on the Singularity container platform.
OpenText™ announced Cloud Editions (CE) 24.2, including OpenText DevOps Cloud and OpenText™ DevOps Aviator.
Postman announced its acquisition of Orbit, the community growth platform for developer companies.
Check Point® Software Technologies Ltd. announced new email security features that enhance its Check Point Harmony Email & Collaboration portfolio: Patented unified quarantine, DMARC monitoring, archiving, and Smart Banners.
Automation Anywhere announced an expanded partnership with Google Cloud to leverage the combined power of generative AI and its own specialized, generative AI automation models to give companies a powerful solution to optimize and transform their business.
Jetic announced the release of Jetlets, a low-code and no-code block template, that allows users to easily build any technically advanced integration use case, typically not covered by alternative integration platforms.
Progress announced new powerful capabilities and enhancements in the latest release of Progress® Sitefinity®.
Buildkite signed a multi-year strategic collaboration agreement (SCA) with Amazon Web Services (AWS), the world's most comprehensive and broadly adopted cloud, to accelerate delivery of cloud-native applications across multiple industries, including digital native, financial services, retail or any enterprise undergoing digital transformation.
AppViewX announced new functionality in the AppViewX CERT+ certificate lifecycle management automation product that helps organizations prepare for Google’s proposed 90-day TLS certificate validity policy.
Rocket Software is addressing the growing demand for integrated security, compliance, and automation in software development with its latest release of Rocket® DevOps, formerly known as Aldon®.