The State of Open Source Vulnerabilities Management in 2019
summary
Open source vulnerabilities grow rapidly — 51% increase in 2018 — while more than 96% of developers rely on components; 97% of reported vulnerabilities include fixes but 86% are sourced from CVE and other databases. Developers spend 15 hours per month on vulnerabilities yet only 3.8 hours actually remediate. Static scanning of 2,000 Java apps shows 70% ineffective (unreachable) vulnerabilities, so classifying effective vs ineffective and tracing calls to the vulnerable code shrinks the worklist to ~30% and saves roughly 10.5 developer hours.
AI-written summary · about
chapters (4)
related talks
30mDevSecOps: Understanding Open Source Software risk in your applications
39mOpen source security: who’s responsible?
25mOWASP Top 10 Risks for Open Source Software
47mThe Open Source Paradox: Unpacking Risk, Equity, and Acceptance
41mManaging the risk and growth of using Open Source Software
58mThe Open Source Paradox: Unpacking Risk, Equity, and Acceptance
38mApplication Security in the age of Open Source
47m11,000 Voices: Experts Shed Light on 4-Year Open Source & AppSec Survey