一句话：提出 Ranger，自动恢复下游依赖的兼容安全版本范围，并配合生态监控缓解 Maven 漏洞持久化。
第三方库漏洞在 Maven 生态中长期存在：补丁虽及时发布，社区仍沿用易受攻击版本，上游依赖阻塞更导致漏洞持续。本文先实证考察 Maven 生态中持久漏洞的普遍性，再基于最新依赖图实现监控漏洞下游依赖者的算法，识别受影响库并量化上游阻塞补丁的现象。针对现有对策不足，作者提出 Ranger，自动为下游依赖恢复兼容且安全的版本范围；其代码为中心的兼容性保证减少升级破坏，且配合生态监控告警阻塞库并推荐灵活版本范围。评估显示，Ranger 可恢复 75.64% 的版本范围，自动修复 90.32% 的脆弱下游项目。
Vulnerabilities from third-party libraries (TPLs) have been unveiled to threaten the Maven ecosystem in the long term. Despite patches being released promptly after vulnerabilities are disclosed, the libraries and applications in the community still use the vulnerable versions, which makes the vulnerabilities persistent in the Maven ecosystem (e.g., the notorious Log4Shell still greatly influences the Maven ecosystem nowadays from 2021). Both academic and industrial researchers have proposed user-oriented standards and solutions to address vulnerabilities, while such solutions fail to tackle the ecosystem-wide persistent vulnerabilities because it requires a collective effort from the community to timely adopt patches without introducing breaking issues. To seek an ecosystem-wide solution, we first carried out an empirical study to examine the prevalence of persistent vulnerabilities in the Maven ecosystem. Then, we identified affected libraries for alerts by implementing an algorithm monitoring downstream dependents of vulnerabilities based on an up-to-date dependency graph. Based on them, we further quantitatively revealed that patches blocked by upstream libraries caused the persistence of vulnerabilities. After reviewing the drawbacks of existing countermeasures, to address them, we proposed a solution for range restoration (Ranger) to automatically restore the compatible and secure version ranges of dependencies for downstream dependents. The automatic restoration requires no manual effort from the community, and the code-centric compatibility assurance ensures smooth upgrades to patched versions. Moreover, Ranger along with the ecosystem monitoring can timely alert developers of blocking libraries and suggest flexible version ranges to rapidly unblock patch versions. By evaluation, Ranger could restore 75.64% of ranges which automatically remediated 90.32% of vulnerable downstream projects.
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@inproceedings{abs-2308-03419,
title = {Mitigating Persistence of Open-Source Vulnerabilities in Maven Ecosystem},
author = {Lyuye Zhang and Chengwei Liu and Sen Chen and Zhengzi Xu and Lingling Fan and Lida Zhao and Yiran Zhang and Yang Liu},
booktitle = {ASE},
year = {2023},
doi = {10.1109/ase56229.2023.00058}
}