Vulnerability Response of Last Resort
summary
Distributions propose acting as a Vulnerability Responder of Last Resort by gathering hard data on abandoned upstreams, routing reports to forks or downstream packagers, helping assign CVEs and coordinating disclosure using GitHub advisories and private reporting, and scanning old PRs. Ubuntu shows growth from 22,000 to 37,000 (plucky ~39,000 source packages) while maintainers lag; researchers find decade‑old PRs (e.g. libspf2, giflib) that lead to 2025 CVE assignments where fixes are often delayed or incomplete.
AI-written summary · about
chapters (9)
- 0:00Undermaintained packages
- 2:29Open source growth challenges
- 8:51Rising CVE numbers
- 11:06Abandonment patterns
- 12:31Reporting vulnerabilities
- 17:51Abandoned security void
- 21:42Fixing abandoned packages
- 23:09Vulnerability responder proposal
- 26:10Next steps and action
related talks
11mVulnerability Supply Chains
29mYou've Got Vulnerability: Exploring Effective Vulnerability Notifications
17mSustaining Yesterday’s Linux: Delivering Security for Today’s Workloads
27mThrough the Looking Glass: How Open Source Projects See Vulnerability Disclosure
37mPackage Vulnerability Management & Reporting Collaboration Space for...
39mFrom Discovery to Fix: What 10,000 Open Source Projects Reveal About CVE Remediation
44mPreparing for Zero-Day: Vulnerability Disclosure in Open Source Software
48mHow to report a vulnerability: Responsible Disclosure for Developers