Veracode: Open-source libraries cause security flaws in 70% of apps

Research from Veracode suggests that 70 percent of apps have security flaws due to their use of open-source libraries.

The application security firm set out to determine the risk one flawed library can pose to software. For its The State of Software Security (SOSS): Open Source Edition report, Veracode analysed 351,000 libraries across the Veracode platform database of 85,000 applications.
On an initial scan, 70 percent of applications were found to have a security flaw resulting from the use of an open-source library.
Chris Eng, Chief Research Officer at Veracode, said:
“Open source software has a surprising variety of flaws. An application’s attack surface is not limited to its own code and the code of explicitly included libraries, because those libraries have their own dependencies.
In reality, developers are introducing much more code, but if they are aware and apply fixes appropriately, they can reduce risk exposure.”
Other key findings in the report include:
  • Around 47 percent of flawed libraries end up in code through being pulled in by upstream libraries.
  • Most flaws in libraries can be fixed with a minor version update, major upgrades are not usually required.
  • More than 61% of flawed libraries in JavaScript contain vulnerabilities without corresponding Common Vulnerabilities and Exposures (CVEs).
Not all programming languages are affected equally. Veracode found that the majority of libraries are transitive dependencies in more than 80 percent of JavaScript, Ruby, and PHP applications.
PHP libraries pose a higher risk; with a greater than 50% chance of having a security flaw.
You can find a full copy of Veracode’s report here.

Comments

Post a Comment

Popular posts from this blog

Making open source JavaScript pay

Image
Money isn’t everything to the success of the most popular JavaScript frameworks. Or is it? Looking at the  2019 State of JavaScript report , something stands out: Money apparently can’t buy everything. Or, at least, not every major front-end and back-end programming framework is sponsored by a big company. Sure, we have Google to thank for  Angular , and Facebook gets credit for  React , but what about  Vue.js ? Or Gatsby? Or Next.js? While these (and other) open source projects do seem to suggest a future without Big Corps shoveling Big Money into open source, the reality is a bit more nuanced. For the developers looking to pay their way through open source, however, reality isn’t nuanced at all. For every Vue.js founder  Evan You making $16,000 per month with Patreon contributions , there are thousands of developers struggling to scrape together $16 for the important open source work they’re doing. [  Also on InfoWorld: 15 great alternatives t...
Read more

What Is Brutalism in Web Design?

Image
3   min read   Brutalism is a special breed of web design, working well for quirky, creative brands and individuals. However, this rule-bending design technique must be employed with care. Read this guide to find out how. Brutalism is one of those trends that seems to come and go in web design. It’s not because there isn’t much value in brutalist design. It’s more that it doesn’t always fit with the style and tone of the times.  That’s part of what makes brutalism so intriguing though. When most websites tend to fall in line and adopt the same basic trends from year to year, a website that doesn’t play by the rules can easily steal the spotlight.  You just need to know whether that’s the right kind of light you want to shine on the brand. Brutalism can sometimes come off as cold and somber. If it’s not properly executed or not used for the right kind of brand, it can send the wrong signals to website visitors.  In this guide to brutalism in web design, we’l...
Read more

How artificial intelligence is making the education system more relevant?

Image
Digital learning solutions equipped with artificial intelligence are making revolutionary changes to the way education is imparted in students with varied interests and capabilities. When we think of artificial intelligence, there is a hardwired imagery of gigantic thinking machines working in sci-fi environment. This imagery often comes from the science fiction that we have been watching or reading since childhood. However, deep diving suggests that artificial intelligence is an advanced form of algorithm that empowers machines to emulate human behavior under real life situations. Today, there is no industry untouched by the ripples caused by artificial intelligence. Education sets the foundation of human behavior. Educational ecosystem is formed by knowledge base, teaching skills and experience, learning capability, and evolving teaching methods. Digital learning solutions equipped with artificial intelligence are making revolutionary changes to the way educat...
Read more