Security is a problem for open source projects, with vulnerabilities in popular open source projects more than doubling year-on-year in 2019

Original title: vulnerabilities in Hot Open Source Projects More than Double in 2019

Source: Open Source China

RiskSense  A new report provides insight into the number of vulnerabilities in popular open source software, including the number of weaponized vulnerabilities, which software is most vulnerable to threats, and the main types of attacks.

The report does not include Linux, WordPress, Drupal and other super popular projects that are often monitored. Instead, look at some other popular open source projects that are not well known to the general public, but are widely adopted by the technology and software community. These include Jenkins, MongoDB, Elasticsearch, Chef, GitLab, Spark, Puppet, and more. & have spent

RiskSense looked at the 50 most popular open source software projects and found:

Vulnerabilities cover all stages of modern development from development/testing, orchestration, container, and workload NBSP; Open source is creating new vulnerabilities at an unprecedented rate. The National Vulnerability Database (NVD) list lags behind in open source software vulnerabilities - especially those with the highest CVSS severity. & have spent

The results show that the total number of vulnerabilities in these open source programs more than doubled by 2019. The number rose from 421 in 2018 to 968 last year. It also points out that the time required to add open source software vulnerabilities to the National Vulnerability Database (NVD) is extremely long, with an average need for NBSP; from public disclosure to inclusion. 54 days. This delay can result in an organization still facing serious application security risks for nearly two months. And this long delay exists at all levels of vulnerability, including those rated "serious" and those that have been weaponized.

Srinivas Mukkamala, chief executive of RiskSense, said: "Although open source code is generally considered more secure than commercial software because it is crowdsourcing to find problems, this study shows that open source vulnerabilities are on the rise and can be a blind spot for many organisations." "Because open source is used and reused everywhere today, when vulnerabilities are discovered, they can have incredibly profound effects."

Other findings include that The Jenkins automated server overall had the most CVE, at 646. MySQL comes next with a number of 624. At the same time, the two open source software projects also accounted for 15 weaponization vulnerabilities. By contrast, HashiCorp's Vagrant has only nine CVes in all, but contains six weaponized loopholes.

In addition, Apache Tomcat, Magento, Kubernetes, Elasticsearch  And & have spent JBoss  There are also some popular bugs. Cross-site scripting (XSS) and input validation vulnerabilities were among the most common and weaponized in the study.

The full report: https://info.risksense.com/open-source-spotlight-report-pr

This paper address: https://www.ithome.com/0/491/787.htm

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia