Mitigating Persistence of Open-Source Vulnerabilities in Maven Ecosystem

Zhang, Lyuye; Liu, Chengwei; Chen, Sen; Xu, Zhengzi; Fan, Lingling; Zhao, Lida; Zhang, Yiran; Liu, Yang

doi:10.1109/ase56229.2023.00058

Cited by 6 publications

(1 citation statement)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Alfadel et al [26] analyzed security vulnerabilities in the PyPI ecosystem and found over 50% were patched after public disclosure. Zhang et al [51,53] analyzed the persistent vulnerabilities in the Maven ecosystem and proposed Ranger to restore secure version ranges against the vulnerabilities. Wu et al [48] studied the reachability of Maven vulnerabilities and found 73% of vulnerabilities are not reachable and safe for downstream users.…”

Section: Related Workmentioning

confidence: 99%

Empirical Analysis of Vulnerabilities Life Cycle in Golang Ecosystem

Hu,

Zhang,

Liu

et al. 2024

Proceedings of the IEEE/ACM 46th International Conference on Software Engineering

View full text Add to dashboard Cite

Open-source software (OSS) greatly facilitates program development for developers. However, the high number of vulnerabilities in open-source software is a major concern, including in Golang, a relatively new programming language. In contrast to other commonly used OSS package managers, Golang presents a distinctive feature whereby commits are prevalently used as dependency versions prior to their integration into official releases. This attribute can prove advantageous to users, as patch commits can be implemented in a timely manner before the releases. However, Golang employs a decentralized mechanism for managing dependencies, whereby dependencies are upheld and distributed in separate repositories. This approach can result in delays in the dissemination of patches and unresolved vulnerabilities.To tackle the aforementioned concern, a comprehensive investigation was undertaken to examine the life cycle of vulnerability in Golang, commencing from its introduction and culminating with its rectification. To this end, a framework was established by gathering data from diverse sources and systematically amalgamating them with an algorithm to compute the lags in vulnerability patching. It turned out that 66.10% of modules in the Golang ecosystem were affected by vulnerabilities. Within the vulnerability life cycle, we found two kinds of lag impeding the propagation of vulnerability fixing. By analyzing reasons behind non-lagged and lagged vulnerabilities, timely releasing and indexing patch versions could significantly enhance ecosystem security.

show abstract

Section: Related Workmentioning

confidence: 99%