Abstract:Today’s software industry heavily relies on open source software (OSS). However, the rapidly increasing number of OSS software vulnerabilities (SVs) poses huge security risks to the software supply chain. Managing the SVs in the relied OSS components has become a critical concern for software vendors. Due to the limited resources in practice, an essential focus for the vendors is to locate and prioritize the remediation of critical SVs (CSVs), i.e., those tend to cause huge losses. Particularly, in the software industry, vendors are obliged to comply with the security service level agreement (SLA), which mandates the fix of CSVs within a short time frame (e.g., 15 days). However, to the best of our knowledge, there is no empirical study that specifically investigates CSVs. The existing works only target at general SVs, missing a view of the unique characteristics of CSVs. In this paper, we investigate the distributions (from temporal, type, and repository dimension) and the current remediation practice of CSVs in the OSS ecosystem, especially their differences compared with non-critical SVs (NCSVs). We adopt the industry standard to refer SVs with a 9+ Common Vulnerability Scoring System (CVSS) score as CSVs and others as NCSVs. We collect a large-scale dataset containing 14,867 SVs and artifacts associated with their remediation (e.g., issue report, commit) across 4,462 GitHub repositories. Our findings regarding CSV distributions can help practitioners better locate these hot spots. Regarding the remediation practice, we observe that though CSVs receive higher priorities, some practices (e.g., complicated review and testing pro-cess) may unintentionally cause the delay to their fixes. We also point out the risks of SV information leakage during remediation process, which could leave a window-of-opportunity of over 30 days on median for zero-day attacks. Based on our findings, we provide implications to improve the current CSV remediation practice.

Going Viral: Case Studies on the Impact of Protestware

Developer Reactions to Protestware in Open Source Software: The cases of color.js and es5.ext

An Investigation into Protestware

Ethical Considerations Towards Protestware

Unveil the Mystery of Critical Software Vulnerabilities

Discovery of Timeline and Crowd Reaction of Software Vulnerability Disclosures

Developers Are Victims Too : A Comprehensive Analysis of The VS Code Extension Ecosystem

In War and Peace: The Impact of World Politics on Software Ecosystems

Talking Trojan: Analyzing an Industry-Wide Disclosure

Exploring the Security Awareness of the Python and JavaScript Open Source Communities

Categorizing Service Worker Attacks and Mitigations

Empirical Study on Detecting Controversy in Social Media

A case study on the development of the German Corona-Warn-App

A Study of Malware Prevention in Linux Distributions

Crossing Margins: Intersectional Users' Ethical Concerns about Software

Using Hashtags to Analyze Purpose and Technology Application of Open-Source Project Related to COVID-19

A Community-Centric Perspective for Characterizing and Detecting Anti-Asian Violence-Provoking Speech

Impact of Cyberattacks by Malicious Hackers on the Competition in Software Markets

Cyber-Security Attacks, Prevention and Malware Detection Application

Proactive Schemes: A Survey of Adversarial Attacks for Social Good

Dynamic Preference Revelation and Expression of Personal Frames: How Weibo is Used in an Anti-Nuclear Protest in China