Hidden Vulnerabilities in Open Source
Talkat Global Security Vulnerability Summit @ Open Source Summit North America 2022 · on Thursday, 2022-06-23· at 14:05· Room 205 (Level 2), JW Marriott Austin, 110 E 2nd Street Austin, TX 78701·
summary
Research finds classes of untracked defects: hidden but visible (commits with explicit fixes), hidden but fixed (bug-like commits that are actually security patches), and hidden undercover (feature-like changes that close exploitable flaws). Examples: Handlebars RCE sits exploitable and public for 58 days, guitea arbitrary-file-deletion for 55 days, and a found npm theme exploit is public for 17 days before CVE. CVE metadata and NVD feeds often omit affected components and fixed versions, and standard scanners commonly miss these un-CVEd threats.
AI-written summary · about
chapters (5)
- 0:00Start
- 4:30Security Issues
- 7:28Who Is Responsible in Open Source
- 9:26Hidden Vulnerabilities
- 14:56Example of Hidden Vulnerability
related talks
51mVulnerabilities Without CVEs: Governing the Dark Matter of Internal and Unknown Software
34mStranger Danger: Finding Security Vulnerabilities Before They Find You!
16mPerformance improvements: exposing hidden security fixes in Open Source
37mStranger Danger: Finding Security Vulnerabilities Before They Find You!
35mStrangerDanger: Finding Security Vulnerabilities Before They Find You!
46mThe Supply Chain Conundrum: Why Traditional Application Security Is...
27mStrangerDanger: Finding Security Vulnerabilities Before They Find You
41mThe CVE Blind Spot: Defeating "Hidden EOLs" and Repo Jacking with Engineering Triage & Code Diet