Lags in the release, adoption, and propagation of npm vulnerability fixes
Lags in the release, adoption, and propagation of npm vulnerability fixes
复制标题
npm 漏洞修复的发布、采用和传播存在滞后
DOI：
10.1007/s10664-021-09951-x
复制
发表时间：
2021
影响因子：
4.1
通讯作者：
Matsumoto Kenichi
中科院分区：
文献类型：
--
作者：
Chinthanet Bodin;Kula Raula Gaikovina;McIntosh Shane;Ishio Takashi;Ihara Akinori;Matsumoto Kenichi
第三方依赖项中的安全漏洞不仅是受影响软件的开发人员越来越关注的问题，而且也越来越关注它给整个软件生态系统带来的风险，例如 Heartbleed 漏洞。最近的研究表明，开发人员对漏洞威胁的响应速度很慢，有时需要四到十一个月的时间才能采取行动。为了确保包含修复程序的版本（修复版本）的快速采用和传播，我们进行了实证调查，以确定存在漏洞的版本与其修复版本（包端修复版本）之间可能出现的滞后。通过对 GitHub 上 npm 项目的 231 个包端修复版本的初步研究，我们发现修复版本很少单独发布，高达 85.72% 的捆绑提交与修复无关。然后，我们将包端修复版本与客户端的更改（客户端修复版本）进行比较。通过对 1,290 个包端修复版本的采用和传播趋势进行实证研究，这些版本影响整个 npm 包的 1,553,325 个版本的网络，我们发现过时的客户端需要额外的迁移工作，即使包端修复版本很快（即包端修复releasetypeSpatch）。此外，我们还展示了包端修复版本所在的分支以及漏洞的严重程度等因素对其传播的影响。除了我们识别和描述的这些滞后之外，本文还为未来研究如何减轻生态系统中的传播滞后奠定了基础。
Security vulnerability in third-party dependencies is a growing concern not only for developers of the affected software, but for the risks it poses to an entire software ecosystem, e.g., Heartbleed vulnerability. Recent studies show that developers are slow to respond to the threat of vulnerability, sometimes taking four to eleven months to act. To ensure quick adoption and propagation of a release that contains the fix (fixing release), we conduct an empirical investigation to identify lags that may occur between the vulnerable release and its fixing release (package-side fixing release). Through a preliminary study of 231 package-side fixing release of npm projects on GitHub, we observe that a fixing release is rarely released on its own, with up to 85.72% of the bundled commits being unrelated to a fix. We then compare the package-side fixing release with changes on a client-side (client-side fixing release). Through an empirical study of the adoption and propagation tendencies of 1,290 package-side fixing releases that impact throughout a network of 1,553,325 releases of npm packages, we find that stale clients require additional migration effort, even if the package-side fixing release was quick (i.e., package-side fixing releasetypeSpatch). Furthermore, we show the influence of factors such as the branch that the package-side fixing release lands on and the severity of vulnerability on its propagation. In addition to these lags we identify and characterize, this paper lays the groundwork for future research on how to mitigate propagation lags in an ecosystem.
影响因子：
3.3
作者：
L. Williams;G. McGraw;Sammy Migues
通讯作者：
Sammy Migues
影响因子：
1.6
作者：
Pearson, Karl
通讯作者：
Pearson, Karl
开源项目安全漏洞修复：以Apache HTTP Server和Apache Tomcat为例
DOI：
--
发表时间：
2019
期刊：
International Conference on Information Control Systems & Technologies
影响因子：
--
作者：
Valentina Piantadosi;Simone Scalabrino;Rocco Oliveto
通讯作者：
Rocco Oliveto