Scalable Management of Vulnerabilities in Open Source
Talkat Global Security Vulnerability Summit @ Open Source Summit North America 2022 · on Friday, 2022-06-24· at 11:10· Brazos (Level 2), JW Marriott Austin, 110 E 2nd Street Austin, TX 78701·
summary
A new machine-readable advisory format called OSV schema encodes exact ecosystem names, package ids and version or commit ranges so automated scanners can map CVEs to real artifacts instead of guessing from freeform text or unreliable CPEs. An open index and toolset at osv.dev API aggregates feeds from PyPI Go Rust GitHub OSS‑Fuzz and the Global Security Database, supports commit‑level bisection and generates advisories from fixes, and the GitHub advisory database accepts community contributions for curated updates. Adoption grows but kernel and distro coverage and false positive reduction remain work in progress.
AI-written summary · about
chapters (7)
- 0:00Start
- 1:24Vulnerability management
- 16:29Commit based vulnerability workflows
- 21:33Community Contributions
- 27:43Lifecycle of an advisory
- 29:32What's next?
- 32:05Questions?
related talks
24mLessons from OSV: Vulnerability Management for Open Source
42mNavigating the Sea of CVEs: Securing Your Linux Distributions
45mSimplifying Coordinating Vulnerabilities & Disclosures in Open Source...
13mSecuring the Software Commons: Standards, Automation, and AI for a Resilie...
37mGoverning Global Vulnerabilities: Standards for Open Source Resilience
01h 08mPreparing for Zero-Day: Vulnerability Disclosure in Open Source Software
25mHow to Answer “What’s Affected?” in Open Source
18mThe Current State of Open Source Security Compliance Tooling Is … Well, Sad.