2020年度开源安全漏洞状态报告（英文版）_12页_10mb

The State of Open Source Security Vulnerabilities Summary

Core Content

The WhiteSource Annual Report 2020 provides an in-depth analysis of the state of open source security vulnerabilities, highlighting both the challenges and progress in the field.

Main Points

• Open Source Usage and Vulnerability Growth:
  Open source components are essential in modern software development, and the number of reported open source security vulnerabilities has been increasing rapidly. In 2019, over 6,000 vulnerabilities were disclosed, representing a nearly 50% increase compared to previous years.

• Vulnerability Disclosure and Fixes:
  Over 85% of open source security vulnerabilities are disclosed with a fix already available. This is largely due to the efforts of tech giants and the open source community in securing and managing projects.

• NVD Coverage:
  Only 84% of known open source vulnerabilities appear in the National Vulnerability Database (NVD), indicating a lack of centralized vulnerability reporting. Many vulnerabilities are reported outside of NVD and may take months to be included.

• 2020 Predictions:
  The trend of increasing open source usage and security research is expected to continue, leading to more reported vulnerabilities. Initiatives like GitHub Security Lab aim to improve the reporting process, but may not resolve the underlying issue of vulnerability overload.

• Most Vulnerable Programming Languages:
  C has the highest percentage of vulnerabilities due to its widespread use. PHP's vulnerability rate has increased significantly, while Python remains relatively secure despite growing popularity.

• Common CWEs in 2019:
  The top five CWEs in 2019 were all related to information disclosure. These include:

  • CWE-79: Cross-site Scripting (XSS)
  • CWE-200: Information Exposure
  • CWE-20: Improper Input Validation
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
  • CWE-125: Out-of-bounds Read

  These CWEs were consistent across most programming languages, with the exception of C.

• CWE-352 and CWE-89:
  These vulnerabilities, though not in the top five, are notable as they have entered the top 10 and re-emerged, respectively. They may indicate a growing concern around web-based vulnerabilities.

• CVSS Scoring Changes:
  The Common Vulnerability Scoring System (CVSS) has evolved, with significant changes from v2 to v3. The new scoring system results in higher scores for many vulnerabilities, leading to an increased number of high and critical severity issues. In CVSS v3.1, 17% of vulnerabilities are critical, and only 2% are low severity.

• Severity Prioritization Challenges:
  With over 55% of vulnerabilities being high-severity or critical, teams face significant challenges in efficiently prioritizing and addressing them. The lack of a perfect severity scoring standard and the time-consuming process of creating a CVE contribute to this imbalance.

Key Takeaways

• Open source security is a growing concern as its usage increases.
• While most vulnerabilities have fixes, the lack of centralized reporting and indexing remains a challenge.
• Programming languages like C, PHP, and others have varying vulnerability rates.
• Information disclosure vulnerabilities are the most common, often due to simple coding errors.
• CVSS v3.1 has shifted the severity distribution, making it harder to prioritize vulnerabilities.
• Keeping open source dependencies up to date is crucial for mitigating security risks.

Conclusion

The open source security landscape is complex, but visibility and control over components can be achieved with the right tools and practices. The report emphasizes the importance of staying informed, regularly updating dependencies, and using automated detection tools to manage the growing number of vulnerabilities.