From CVD to Secure Releases: Automating Security from Source to Releases
summary
Asserts that Coordinated Vulnerability Disclosure must move from notification to active fixes by integrating with GitHub/GitLab and registries (npm, PyPI), shifting security left and automating release checks. Presents a patch-first workflow: require positive and negative test cases, preserve maintainer coding style, and emit CVE-formatted metadata so tools like npm audit and pip-audit pick up fixes. Demonstrates with SGLang case studies (pickle deserialization and GGUF RCE), shows some fixes are a few lines and got merged while many reports see no response, and proposes a Voltron state machine to track patch-to-release progress.
AI-written summary · about
chapters (7)
- 0:00CVD and research focus
- 1:02CERT/CC mission and challenges
- 7:25AI impact on vulnerabilities
- 13:23Extending CVD for secure releases
- 24:41SG Lang case study
- 33:28Open-source AI security conclusions
- 35:19Q&A
related talks
45mSimplifying Coordinating Vulnerabilities & Disclosures in Open Source...
48mImproving the Security of a Large Open Source Project One Step...
27mThrough the Looking Glass: How Open Source Projects See Vulnerability Disclosure
30mDance Madly on the Lip of a Volcano
37mA Secure Continuous Delivery Pipeline
46mRugged Software Engineering
30mManaging Vulnerabilities through SSDLC
49mImproving FOSS Security