GitHub Buys Semmle, Becomes CVE Numbering Authority
Written by Kay Ewbank   
Thursday, 19 September 2019

GitHub has acquired code analysis company Semmle and will make Semmle's code analyis engine available to all public repositories. GitHub has also become a Common Vulnerabilities and Exposures (CVE) Numbering Authority, making it easier to report vulnerabilities directly from your repositories.

Semmle's main product, QL, is a code analysis tool that you can use to find potential vulnerabilities in your code. It has a query language that you can use to write and execute QL queries locally from most IDEs using a QL plugin, or there's a query console for use in your web browser.  The Semmle team says QL performs variant analysis, where a known vulnerability is used as a seed to find similar problems in your code. QL ships with libraries to perform control and data flow analysis, taint tracking and explore known threat models. Supported languages include C/C++, C#, Java, JavaScript, and Python.


QL is also used in Semmle’s other main product, LGTM (Looks Good to Me). which analyses every commit to identify vulnerabilities early. LGTM automatically runs over 1,600 standard analyses on every code change. GitHub plans to make QL available via GitHub Actions. According to Semmle more than 100 open source CVEs have been found using QL.

In a related announcement, GitHub said it has become a CVE Numbering Authority for open source projects. Common Vulnerabilities and Exposures (CVE) Numbering Authorities are authorized to assign CVE IDs to vulnerabilities affecting products in a particular area - open source projects in this case. The CVE IDs are then included in first-time public announcements of new vulnerabilities.  The fact that GitHub is a CVE Numbering Authority will make it easier for code maintainers to report vulnerabilities directly from their repositories. GitHub will assign a CVE ID, post to the CVE List, and then to the National Vulnerability Database (NVD) on a developer’s behalf.

Commenting on the announcements, Shanku Niyogi, GitHub SVP, said:

"We believe that fast, unfettered movement of vulnerability data is critical to improving software security"


More Information

Semmle Homepage

GitHub Homepage

Related Articles

GitHub Adds New Code Security Features

GitHub Acquires Pull Panda

Counting Vulnerabilities In Open Source Projects and Programming Languages

Don't Neglect Open Source Security

GitHub Sponsors - Money For Open Source

GitHub Bug Bounty Program Expanded In Scope and Reward 

Microsoft GitHub - What's Different  

To be informed about new articles on I Programmer, sign up for our weekly newsletter, subscribe to the RSS feed and follow us on Twitter, Facebook or Linkedin.


BitLocker Defeated Using Logic Analyser

Security is hard, very hard, in fact so hard that I really don't think a device can be secure if you have physical access to it. To prove the point news that Bitlocker can be bypassed if you have a ch [ ... ]

The DevOps with Docker Course From Finland

A course by Jami Kousa of University of Helsinki teaches Docker from zero to hero. It's free and self-paced and contains a lot of material you need to work through from start to finish.

More News

Summer SALE Kindle 9.99 Paperback $10 off!!




or email your comment to:

Last Updated ( Thursday, 19 September 2019 )