OSV and the Life of an Open Source Vulnerability - Andrew Pollock, Google
OSV and the Life of an Open Source Vulnerability - Andrew Pollock, Google
Managing vulnerabilities in open source dependencies is surprisingly hard for many different reasons for different people. OSV (“Open Source Vulnerabilities”) was created to address this and to make vulnerability management easy at all points of the software development life cycle. This starts with a comprehensively accurate, distributed vulnerability database that uses a consistent format for describing affected software and versions in open source. The OSV Schema was created for this purpose, and has seen adoption from various open source ecosystems. This talk will walk through some examples of implementations of the OSV Schema, and also how OSV also solves the challenges with vulnerabilities in C/C++ libraries. We’ll also work through a typical software development life cycle and where OSV fits in, with a particular focus on vulnerability remediation. Easy remediation of known vulnerabilities is a hairy and unsolved problem. A common problem with vulnerability scanners is they can generate overwhelming reports. We’ll talk through ways to reduce false positives and auto-generate VEX statements, and a “guided remediation” workflow with some real world examples to reduce the work someone has to do to remediate all their known vulnerabilities in their dependency graph.