‍

The Data

Based on Lineaje Labs research a staggering 77% of vulnerabilities in open-source reside within transitive dependencies (which your developers cannot patch). Open Source Projects pull in 20+ levels of dependencies. Along with those dependencies come their vulnerabilities. Lineaje AI labs analyzed 121,443 open source projects and discovered 118,573 vulnerabilities in them.

‍

• Fixable by your developers: 23% of vulnerabilities are in direct dependencies. These are patchable when fixes are available as independent patches, minor updates or major version upgrades.
• ‍Mostly not fixable by your developers: 77% of vulnerabilities are in transitive dependencies. Patching these is complicated. Less than 32% of all fixes available are in the form of independent patches. Even picking up independent patches for Transitive Dependency Level 2 and below can break your dependency and your application.

The Implication

‍

• A Paradigm Shift in Vulnerability Management: This statistic underscores the need for a paradigm shift in how we manage vulnerabilities. Developers and security teams must now broaden their scope beyond direct dependencies, conducting thorough evaluations of the entire software supply chain dependency tree.
• ‍Collaboration is Key: With the majority of vulnerabilities residing in transitive dependencies, fostering strong collaboration within the open-source community becomes paramount. Sharing knowledge, experiences, and best practices for managing dependencies will strengthen the collective effort to secure the open-source ecosystem.
  
• Strategic Decision-making on Alternatives or “Inner Source”: In cases where transitive dependencies pose insurmountable risks, project stakeholders may need to consider alternatives. This could involve exploring different components or even opting for custom solutions by building components in-house (inner source).
• Elevated Trust in Open-Source Software: By actively managing vulnerabilities in transitive dependencies, the open-source community can build and maintain trust with users. This transparency and dedication to security demonstrate a commitment to providing reliable and secure software solutions.
• Beware App-sec tools pushing “quick vulnerability remediation”: Asking your developers to patch vulnerabilities in transitive dependencies is a risky, sub-optimal approach to vulnerability remediation.