Abstract:Today’s software industry heavily relies on open source software (OSS). However, the rapidly increasing number of OSS software vulnerabilities (SVs) poses huge security risks to the software supply chain. Managing the SVs in the relied OSS components has become a critical concern for software vendors. Due to the limited resources in practice, an essential focus for the vendors is to locate and prioritize the remediation of critical SVs (CSVs), i.e., those tend to cause huge losses. Particularly, in the software industry, vendors are obliged to comply with the security service level agreement (SLA), which mandates the fix of CSVs within a short time frame (e.g., 15 days). However, to the best of our knowledge, there is no empirical study that specifically investigates CSVs. The existing works only target at general SVs, missing a view of the unique characteristics of CSVs. In this paper, we investigate the distributions (from temporal, type, and repository dimension) and the current remediation practice of CSVs in the OSS ecosystem, especially their differences compared with non-critical SVs (NCSVs). We adopt the industry standard to refer SVs with a 9+ Common Vulnerability Scoring System (CVSS) score as CSVs and others as NCSVs. We collect a large-scale dataset containing 14,867 SVs and artifacts associated with their remediation (e.g., issue report, commit) across 4,462 GitHub repositories. Our findings regarding CSV distributions can help practitioners better locate these hot spots. Regarding the remediation practice, we observe that though CSVs receive higher priorities, some practices (e.g., complicated review and testing pro-cess) may unintentionally cause the delay to their fixes. We also point out the risks of SV information leakage during remediation process, which could leave a window-of-opportunity of over 30 days on median for zero-day attacks. Based on our findings, we provide implications to improve the current CSV remediation practice.

Vulnerability Forecasting: In theory and practice

Towards More Practical Automation of Vulnerability Assessment

Early and Realistic Exploitability Prediction of Just-Disclosed Software Vulnerabilities: How Reliable Can It Be?

Vulnerability Time Series Prediction Based on Multivariable LSTM

Unveil the Mystery of Critical Software Vulnerabilities

Fine-grained Commit-level Vulnerability Type Prediction by CWE Tree Structure.

Predicting Exploitation of Disclosed Software Vulnerabilities Using Open-source Data

Patching zero-day vulnerabilities: an empirical analysis

The Holy Grail of Vulnerability Predictions

Deep ahead-of-threat virtual patching

Forecasting the risk of software choices: A model to foretell security vulnerabilities from library dependencies and source code evolution

Software Updates Strategies: a Quantitative Evaluation against Advanced Persistent Threats

Enhancing Vulnerability Prioritization: Data-Driven Exploit Predictions with Community-Driven Insights

Half-Day Vulnerabilities: A study of the First Days of CVE Entries

Vulnerability Detection is Just the Beginning

Combining Software Metrics and Text Features for Vulnerable File Prediction

A Historical and Statistical Studyof the Software Vulnerability Landscape

Vulnerability Prioritization: An Offensive Security Approach

Are Latent Vulnerabilities Hidden Gems for Software Vulnerability Prediction? An Empirical Study

Software Vulnerability Analysis Using CPE and CVE

Software vulnerability prediction using text analysis techniques