Abstract:Today’s software industry heavily relies on open source software (OSS). However, the rapidly increasing number of OSS software vulnerabilities (SVs) poses huge security risks to the software supply chain. Managing the SVs in the relied OSS components has become a critical concern for software vendors. Due to the limited resources in practice, an essential focus for the vendors is to locate and prioritize the remediation of critical SVs (CSVs), i.e., those tend to cause huge losses. Particularly, in the software industry, vendors are obliged to comply with the security service level agreement (SLA), which mandates the fix of CSVs within a short time frame (e.g., 15 days). However, to the best of our knowledge, there is no empirical study that specifically investigates CSVs. The existing works only target at general SVs, missing a view of the unique characteristics of CSVs. In this paper, we investigate the distributions (from temporal, type, and repository dimension) and the current remediation practice of CSVs in the OSS ecosystem, especially their differences compared with non-critical SVs (NCSVs). We adopt the industry standard to refer SVs with a 9+ Common Vulnerability Scoring System (CVSS) score as CSVs and others as NCSVs. We collect a large-scale dataset containing 14,867 SVs and artifacts associated with their remediation (e.g., issue report, commit) across 4,462 GitHub repositories. Our findings regarding CSV distributions can help practitioners better locate these hot spots. Regarding the remediation practice, we observe that though CSVs receive higher priorities, some practices (e.g., complicated review and testing pro-cess) may unintentionally cause the delay to their fixes. We also point out the risks of SV information leakage during remediation process, which could leave a window-of-opportunity of over 30 days on median for zero-day attacks. Based on our findings, we provide implications to improve the current CSV remediation practice.

Industry-Wide Analysis of Open Source Security.

Unveil the Mystery of Critical Software Vulnerabilities

A Large-Scale Empirical Study of Open Source License Usage: Practices and Challenges

The Code the World Depends On: A First Look at Technology Makers' Open Source Software Dependencies

An Overview of Cyber Security Funding for Open Source Software

OSS PESTO: An Open Source Software Project Evaluation and Selection TOol

Vulnerabilities and Security Patches Detection in OSS: A Survey

Enterprise-Driven Open Source Software: A Case Study on Security Automation

Exploratory Analysis of Quality Practices in Open Source Domain

A Mixed-Methods Study of Open-Source Software Maintainers On Vulnerability Management and Platform Security Features

Risk Based Testing of Open Source Software (OSS)

Software Supply Chain Risk Assessment Framework

What Security Questions Do Developers Ask? A Large-Scale Study of Stack Overflow Posts.

Understanding the Practice of Security Patch Management Across Multiple Branches in OSS Projects

The Influence of Risk Factors in Decision-Making Process for Open Source Software Adoption

Causative Insights into Open Source Software Security using Large Language Code Embeddings and Semantic Vulnerability Graph

Towards a Critical Open-Source Software Database

OSS Malicious Package Analysis in the Wild

Security Requirements Engineering in the Wild: A Survey of Common Practices

A Landscape Study of Open Source and Proprietary Tools for Software Bill of Materials (SBOM)

Data Driven Testing of Open Source Software.