Skip to Main content Skip to Navigation
Conference papers

Open Source Vulnerability Notification

Abstract : The use of third-party libraries to manage software complexity can expose open source software projects to vulnerabilities. However, project owners do not currently have a standard way to enable private disclosure of potential security vulnerabilities. This neglect may be caused in part by having no template to follow for disclosing such vulnerabilities. We analyzed 600 GitHub projects to determine how many projects contained a vulnerable dependency and whether the projects had a process in place to privately communicate security issues. We found that 385 out of 600 open source Java projects contained at least one vulnerable dependency, and only 13 of those 385 projects had a security vulnerability reporting process. That is, 96.6% of the projects with a vulnerability did not have a security notification process in place to allow for private disclosure. In determining whether the projects even had contact information publicly available, we found that 19.8% had no contact information publicly available, let alone a security vulnerability reporting process. We suggest two methods to allow for community members to privately disclose potential security vulnerabilities.
Document type :
Conference papers
Complete list of metadata

Cited literature [19 references]  Display  Hide  Download

https://hal.inria.fr/hal-02305712
Contributor : Hal Ifip <>
Submitted on : Friday, October 4, 2019 - 2:30:01 PM
Last modification on : Friday, October 4, 2019 - 2:37:35 PM

File

 Restricted access
To satisfy the distribution rights of the publisher, the document is embargoed until : 2022-01-01

Please log in to resquest access to the document

Licence


Distributed under a Creative Commons Attribution 4.0 International License

Identifiers

Citation

Brandon Carlson, Kevin Leach, Darko Marinov, Meiyappan Nagappan, Atul Prakash. Open Source Vulnerability Notification. 15th IFIP International Conference on Open Source Systems (OSS), May 2019, Montreal, QC, Canada. pp.12-23, ⟨10.1007/978-3-030-20883-7_2⟩. ⟨hal-02305712⟩

Share

Metrics

Record views

55