Out of sight, out of mind? How vulnerable dependencies affect open-source projects

• Published in: Empirical software engineering : an international journal Vol. 26; no. 4
• Main Authors: Prana, Gede Artha Azriadi, Sharma, Abhishek, Shar, Lwin Khin, Foo, Darius, Santosa, Andrew E., Sharma, Asankhaya, Lo, David
• Format: Journal Article
• Language: English
• Published: New York Springer US 01.07.2021; Springer Nature B.V
• Subjects: Compilers; Computer Science; Denial of service attacks; Dependence; Interpreters; Libraries; Open source software; Programming Languages; Security; Software development; Software Engineering/Programming and Operating Systems; Security; Empirical study; Software composition analysis
• ISSN: 1382-3256; 1573-7616
• DOI: 10.1007/s10664-021-09959-3

Context Software developers often use open-source libraries in their project to improve development speed. However, such libraries may contain security vulnerabilities, and this has resulted in several high-profile incidents in recent years. As usage of open-source libraries grows, understanding of these dependency vulnerabilities becomes increasingly important. Objective In this work, we analyze vulnerabilities in open-source libraries used by 450 software projects written in Java, Python, and Ruby. Our goal is to examine types, distribution, severity, and persistence of the vulnerabilities, along with relationships between their prevalence and project as well as commit attributes. Method Our data is obtained by scanning versions of the sample projects after each commit made between November 1, 2017 and October 31, 2018 using an industrial software composition analysis tool, which provides information such as library names and versions, dependency types (direct or transitive), and known vulnerabilities. Results Among other findings, we found that project activity level, popularity, and developer experience do not translate into better or worse handling of dependency vulnerabilities. We also found “Denial of Service” and “Information Disclosure” types of vulnerabilities being common across the languages studied. Further, we found that most dependency vulnerabilities persist throughout the observation period (mean of 78.4%, 97.7%, and 66.4% for publicly-known vulnerabilities in our Java, Python, and Ruby datasets respectively), and the resolved ones take 3-5 months to fix. Conclusion Our results highlight the importance of managing the number of dependencies and performing timely updates, and indicate some areas that can be prioritized to improve security in wide range of projects, such as prevention and mitigation of Denial-of-Service attacks.