{"id":110893,"date":"2023-10-17T09:10:18","date_gmt":"2023-10-17T07:10:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/oczenka-problem-s-soprovozhdeniem-otkrytyh-proektov-i-ispolzovaniem-staryh-zavisimostej"},"modified":"2023-10-17T09:10:18","modified_gmt":"2023-10-17T07:10:19","slug":"oczenka-problem-s-soprovozhdeniem-otkrytyh-proektov-i-ispolzovaniem-staryh-zavisimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/oczenka-problem-s-soprovozhdeniem-otkrytyh-proektov-i-ispolzovaniem-staryh-zavisimostej","title":{"rendered":"Hodnocen\u00ed probl\u00e9m\u016f s \u00fadr\u017ebou otev\u0159en\u00fdch projekt\u016f a pou\u017e\u00edv\u00e1n\u00edm star\u00fdch z\u00e1vislost\u00ed","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Spole\u010dnost Sonatype, specializuj\u00edc\u00ed se na ochranu p\u0159ed \u00fatoky manipuluj\u00edc\u00edmi s podvr\u017een\u00edm softwarov\u00fdch komponent a z\u00e1vislost\u00ed (supply chain), zve\u0159ejnila v\u00fdsledky v\u00fdzkumu (PDF, 62 str.) probl\u00e9m\u016f se z\u00e1vislostmi a \u00fadr\u017ebou otev\u0159en\u00fdch projekt\u016f v jazyc\u00edch Java, JavaScript, Python a .NET, kter\u00e9 jsou prezentov\u00e1ny v repozit\u00e1\u0159\u00edch Maven Central, NPM, PyPl a Nuget. B\u011bhem roku bylo zaznamen\u00e1no zv\u00fd\u0161en\u00ed po\u010dtu projekt\u016f v sledovan\u00fdch otev\u0159en\u00fdch ekosyst\u00e9mech v pr\u016fm\u011bru o 29 %. Po\u010det sta\u017een\u00ed bal\u00ed\u010dk\u016f z prozkouman\u00fdch repozit\u00e1\u0159\u016f v roce 2023 vzrostl o 33 %, zat\u00edmco pro srovn\u00e1n\u00ed v roce 2021 vzrostl po\u010det sta\u017een\u00ed o 73 %. <\/p>\n
Malware activity in repositories has significantly increased \u2014 since the beginning of the year, 245,000 malicious packages have been detected, and the number of recorded attacks aimed at dependency substitution has doubled.
<\/center> <\/p>\n
Mnoho projekt\u016f pokra\u010duje v pou\u017e\u00edv\u00e1n\u00ed zraniteln\u00fdch verz\u00ed, nap\u0159\u00edklad 23 % sta\u017een\u00ed Java bal\u00ed\u010dku Log4j st\u00e1le p\u0159edstavuj\u00ed verze s kritick\u00fdmi zranitelnostmi, kter\u00e9 byly odstran\u011bny v roce 2021. V repozit\u00e1\u0159i Maven Central asi 12 % v\u0161ech sta\u017een\u00ed p\u0159ipad\u00e1 na komponenty obsahuj\u00edc\u00ed zn\u00e1m\u00e9 zranitelnosti. V pr\u016fm\u011bru pro v\u0161echny repozit\u00e1\u0159e pod\u00edl sta\u017een\u00ed star\u00fdch verz\u00ed bal\u00ed\u010dk\u016f, kter\u00e9 pat\u0159\u00ed do kategori\u00ed rizikov\u00fdch (nap\u0159\u00edklad s neopraven\u00fdmi zranitelnostmi), \u010din\u00ed 20 % (v 80 % p\u0159\u00edpad\u016f se stahuje aktu\u00e1ln\u00ed verze). Ve 96 % p\u0159\u00edpad\u016f bylo mo\u017en\u00e9 se vyhnout stahov\u00e1n\u00ed komponent se zranitelnostmi volbou verz\u00ed, v nich\u017e ji\u017e byla probl\u00e9m odstran\u011bn. <\/p>\n
A significant challenge in maintaining security is the quality of project support. In the ecosystems for Java and JavaScript languages, this poses serious issues \u2014 over the past year, support has been discontinued for every fifth project (18.6%) listed in Maven Central and NPM, which was supported in the previous year. Out of 1.176 million analyzed projects present in the Maven, NPM, PyPl, and Nuget repositories, only 11% (118,000) continue to receive active support. <\/p>\n
The study also included a survey of 621 professional developers from various companies. 67% of respondents believe that their applications do not use vulnerable libraries, 10% have encountered security incidents in the past 12 months caused by vulnerabilities in open-source software, while 20% find it difficult to respond. 28% of companies identify the presence of vulnerable components within 1 day after vulnerability information is disclosed, 39% \u2014 from 1 to 7 days, and 29% \u2014 more than a week. \n Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"Hodnocen\u00ed](\"\/wp-content\/uploads\/2023\/10\/51959a6d676e0ad5ee98884567dd49ec.png\")
<\/center> <\/p>\n