Story image

Report: Open source software plagued with vulnerabilities

21 May 18

The adoption of open source software and components has permeated almost every aspect of technology, but the number of vulnerabilities per commercial codebase are increasing at almost the same rate – and even cybersecurity applications are at risk.

The Black Duck by Synopsys 2018 Open Source Security and Risk Analysis (OSSRA) report scanned more than 1100 commercial codebases across industries including automotive, big data, cybersecurity, IoT, mobile apps, financial services, manufacturing, healthcare, and enterprise software.

"Since modern software and infrastructure depend heavily on open source technologies, having a clear view of components in use is a key part of corporate governance," says Black Duck by Synopsys technical evangelist Tim Mackey.

The report found that 96% of the scanned applications contained open source components, with an average of 257 components per codebase.  

While the number of components per codebase has increased 75% over the previous year, more codebanks often contain more open source than proprietary code.  

In addition, 78% of the examined codebases contained at least one open source vulnerability, with an average of 64 vulnerabilities per codebase.

The report says that 54% of the vulnerabilities found are considered high-risk vulnerabilities. Furthermore, 17% contained highly-publicised vulnerabilities like Heartbleed, Poodle, Drown, Freak, and Logjam.

"The report clearly demonstrates that with the growth in open source use, organisations need to ensure they have the tools to detect vulnerabilities in open source components and manage whatever license compliance their use of open source may require,” Mackey continues.

The internet and software infrastructure vertical is the most at-risk: 67% of applications contained high-risk open source vulnerabilities.

The cybersecurity vertical was also heavily affected – 41% of applications have high-risk open source vulnerabilities.

The report also offers insights into the Equifax breach, which was compromised through Apache Struts.

Overall, 33% of the audited codebases that contained Apache Struts also contained the vulnerability that caused the Equifax breach.  On average, identified vulnerabilities in the report’s audit were disclosed almost six years ago.

"When Equifax was breached through the Apache Struts vulnerability, the need for open source security management became front-page news," says Black Duck product marketing manager responsible for the OSSRA report, Evan Klein.

"Yet even though it was disclosed in March 2017, many organisations apparently still have not checked their applications for the Struts vulnerability."

The report also found that 74% of the codebases audited also contained components with license conflicts, the most common of which were GPL license violations.

The percentage of applications with license conflicts within verticals ranged from the retail and ecommerce industry's relative low of 61% to the high of the telecommunications and wireless industry—where 100% of the code scanned had some form of open source license conflict.

Using blockchain to ensure regulatory compliance
“Data privacy regulations such as the GDPR require you to put better safeguards in place to protect customer data, and to prove you’ve done it."
A10 aims to secure Kubernetes container environments
The solution aims to provide teams deploying microservices applications with an automated way to integrate enterprise-grade security with comprehensive application visibility and analytics.
DigiCert conquers Google's distrust of Symantec certs
“This could have been an extremely disruptive event to online commerce," comments DigiCert CEO John Merrill. 
One Identity a Visionary in Magic Quad for PAM
One Identity was recognised in the Gartner Magic Quadrant for Privileged Access Management for completeness of vision and ability to execute.
Gartner names newcomer Exabeam a leader in SIEM
The vendor landscape for SIEM is evolving, with recent entrants bringing technologies optimised for analytics use cases.
52mil users affected by Google+’s second data breach
Google+ APIs will be shut down within the next 90 days, and the consumer platform will be disabled in April 2019 instead of August 2019 as originally planned.
Symantec releases neural network-integrated USB scanning station
Symantec Industrial Control System Protection Neural helps defend against USB-borne cyber attacks on operational technology.
Ramping up security with next-gen firewalls
The classic firewall lacked the ability to distinguish between different kinds of web traffic.