Using GraphDB Technology to Resolve Transitive Vulnerabilities at Scale
summary
Built a global dependency graph from package registries using a Python scraper, RabbitMQ and Neo4j, then injects custom Java procedures to model each ecosystem’s resolver. It claims to compute root-version updates that guarantee transitive vulnerabilities are avoided (npm uses a max-path traversal), returns concrete suggestions (example: forces trim-newlines to 3.0.1), and runs depths of 15 almost instantly compared to hours for pure Cypher. Deployed as part of Debricked’s toolchain and shown to work on real npm, Maven, pip and Go trees.
AI-written summary · about
chapters (13)
- 0:00Intro
- 1:19What is open source security?
- 4:37The tree of open source
- 5:59Transitive vulnerabilities
- 11:01Solution: Update the root
- 12:35How different ecosystems work
- 12:48Python
- 14:44Java
- 16:27JavaScript
- 18:08Go
- 20:17How we solve the problem
- 22:36Neo4j demo
- 38:43Outro
related talks
31mTransforming Vulnerability Management with Advanced Dependency Knowledge Graphs
40mDependency Management: The Cause of—and Solution to—All Supply...
20mEfficient Static Vulnerability Analysis for JavaScript with Multiversion Dependency Graphs
38mDependency Management: The Cause of—and Solution to—All Supply...
40mTransitive Vulnerabilities Exploit In Real-life
31mSix Degrees of Infiltration- 38mDependency Management: The Cause of—and Solution to—All Supply Chain Problems
30mDependency management: the cause of—and solution to—all supply chain problems