A Glimpse Into OSS Vulnerability Disclosure Practices
summary
Study analyzes ~4,500 GitHub security advisories plus Hunter and HackerOne bug bounties, finds reviewed advisories average 177 per month leaving a backlog that would take 95 years to clear, and that advisories reach the NVD about 1.8× faster than bounty reports while bounties’ CVEs are 1.9× more often missing. 66% of missing CVEs stall at CNA publication (step 6), 63.4% of affected projects lack public security advisories, and 76.1% disable private reporting; recommends CNA process fixes and automated review aids.
AI-written summary · about
chapters (9)
- 0:00Introduction and setup
- 1:24Focus on open source maintainers
- 4:59Review turnaround times analysis
- 8:56CVEs and NVD routing efficiency
- 12:33Gaps in vulnerability management
- 16:58Maintainer challenges in reviews
- 20:53Benefits and incentives for maintainers
- 25:06Future research directions
- 27:13Q&A and closing
related talks
44mPreparing for Zero-Day: Vulnerability Disclosure in Open Source Software
24mSecurity Advisories and Vulnerability Prioritization in the Wild
43mReducing Ratio of Reserved But Public CVEs
27mThrough the Looking Glass: How Open Source Projects See Vulnerability Disclosure
49mImproving FOSS Security
16mPerformance improvements: exposing hidden security fixes in Open Source
39mCVE 101: The Unfolding Of A Zero Day Attack
39mSecurity Advisory Programs: Creating Transparency Along the Software Supply Chain