一句话：提出识别开源软件漏洞受影响库版本的新思路，强调跨包注册表一致性并区分漏洞方法与补丁语句的重要性。
本文是一篇愿景论文，聚焦开源软件漏洞报告中受影响库版本不准确的问题。由于多版本及其差异，维护版本准确性尤其困难。现有识别方法存在两个局限：部分方法依赖 GitHub 等代码托管平台，所得版本与 Maven 等包注册表中的版本并不总是一致；此外，当漏洞涉及多个方法和多个变更块时，现有方法未能区分不同漏洞方法和补丁语句的重要性。本文据此提出识别受影响库版本的研究愿景，旨在克服上述局限，提升漏洞报告中受影响版本识别的准确性和一致性。
Vulnerability reports play a crucial role in mitigating open-source software risks. Typically, the vulnerability report contains affected versions of a software. However, despite the validation by security expert who discovers and vendors who review, the affected versions are not always accurate. Especially, the complexity of maintaining its accuracy increases significantly when dealing with multiple versions and their differences. Several advances have been made to identify affected versions. However, they still face limitations. First, some existing approaches identify affected versions based on repository-hosting platforms (i.e., GitHub), but these versions are not always consistent with those in package registries (i.e., Maven). Second, existing approaches fail to distinguish the importance of different vulnerable methods and patched statements in face of vulnerabilities with multiple methods and change hunks.
DOI 原文 ·
@inproceedings{paperbot8359,
title = {Vision: Identifying Affected Library Versions for Open Source Software Vulnerabilities},
author = {Susheng Wu and Ruisi Wang and Kaifeng Huang and Yiheng Cao and Wenyan Song and Zhuotong Zhou and Yiheng Huang and Bihuan Chen and Xin Peng},
booktitle = {ASE},
year = {2024},
doi = {10.1145/3691620.3695516}
}