一句话：聚焦开源软件漏洞补丁追踪，关注漏洞数据库补丁质量并指出现有方法局限。
开源软件漏洞威胁使用这些软件的系统安全。漏洞数据库通常提供受影响版本和补丁等信息，以帮助缓解漏洞，因此其信息质量日益受到关注。然而，现有漏洞数据库中补丁信息的质量尚不明确；同时，现有补丁追踪方法要么依赖人工、成本过高，要么过于特定、难以适用于所有开源软件漏洞。论文以“追踪开源软件漏洞的补丁”为题，针对上述问题展开研究。但给出的摘要未说明其具体方法、技术路线以及实验评估与关键结果，因此无法从摘要判断其提出的新方法或其效果。
Open source software (OSS) vulnerabilities threaten the security of software systems that use OSS. Vulnerability databases provide valuable information (e.g., vulnerable version and patch) to mitigate OSS vulnerabilities. There arises a growing concern about the information quality of vulnerability databases. However, it is unclear what the quality of patches in existing vulnerability databases is; and existing manual or heuristic-based approaches for patch tracking are either too expensive or too specific to apply to all OSS vulnerabilities.
DOI 原文 ·
@inproceedings{paperbot7021,
title = {Tracking patches for open source software vulnerabilities},
author = {Congying Xu and Bihuan Chen and Chenhao Lu and Kaifeng Huang and Xin Peng and Yang Liu},
booktitle = {FSE},
year = {2022},
doi = {10.1145/3540250.3549125}
}