Veracode has published the results of a study on security issues caused by embedding open libraries in applications (instead of dynamic linking, many companies simply copy the necessary libraries into their projects). As a result of scanning 86,000 repositories and surveying about two thousand developers, it was determined that 79% of third-party libraries incorporated into code are never updated afterwards.
At the same time, outdated library code leads to security issues, which can be avoided in 92% of cases through simple library code updates. The excuse that updating libraries is not done due to potential compatibility issues is mostly unfounded, as in 69% of cases, vulnerabilities were fixed in patches that did not change functionality.
The impact of informing developers about vulnerabilities is also significant — when developers were notified of an issue in the library, the problem was resolved within an hour in 17% of cases and within one week in 25%. When information was available on how a vulnerability in the library could lead to application compromise, fixes were issued within three weeks in 50% of cases. Without that information, it took seven months or more to address vulnerabilities. A quarter of the surveyed developers stated that when choosing a library for embedding, the primary focus is on functionality and code licensing, with security considered afterwards.
Notably, the situation with checking code licenses is not much better — 54% of respondents admitted that they do not always check the license of a library before integrating it into their product. Mandatory checking of licensing compatibility is practiced by only 27% of respondents.
Source: opennet.ru
