{"id":110893,"date":"2023-10-17T09:10:18","date_gmt":"2023-10-17T07:10:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/oczenka-problem-s-soprovozhdeniem-otkrytyh-proektov-i-ispolzovaniem-staryh-zavisimostej"},"modified":"2023-10-17T09:10:18","modified_gmt":"2023-10-17T07:10:19","slug":"oczenka-problem-s-soprovozhdeniem-otkrytyh-proektov-i-ispolzovaniem-staryh-zavisimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/oczenka-problem-s-soprovozhdeniem-otkrytyh-proektov-i-ispolzovaniem-staryh-zavisimostej","title":{"rendered":"Utv\u00e4rdering av problem med underh\u00e5ll av \u00f6ppna projekt och anv\u00e4ndning av gamla beroenden","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Sonatype, ett f\u00f6retag som specialiserar sig p\u00e5 skydd mot attacker som manipulerar programkomponenter och beroenden (supply chain), har publicerat resultaten av en studie (PDF, 62 sidor) om problem med beroenden och underh\u00e5ll av \u00f6ppna projekt p\u00e5 spr\u00e5ken Java, JavaScript, Python och .NET, representerade i Maven Central, NPM, PyPl och Nuget. Under det senaste \u00e5ret har antalet projekt i de \u00f6vervakade \u00f6ppna ekosystemen \u00f6kat med i genomsnitt 29%. Antalet nedladdningar av paket fr\u00e5n de granskade repositories har \u00f6kat med 33% under 2023, men f\u00f6r j\u00e4mf\u00f6relse \u00f6kade antalet nedladdningar med 73% under 2021. <\/p>\n
Malicious activity in repositories has significantly increased \u2014 since the beginning of the year, 245,000 malicious packages have been identified, and the number of recorded attacks aimed at replacing dependencies has doubled.
<\/center> <\/p>\n
M\u00e5nga projekt forts\u00e4tter att anv\u00e4nda s\u00e5rbara versioner, till exempel utg\u00f6r 23% av nedladdningarna av Java-paketet Log4j fortfarande versioner med kritiska s\u00e5rbarheter som \u00e5tg\u00e4rdades 2021. I Maven Central kommer cirka 12% av alla nedladdningar fr\u00e5n komponenter som inneh\u00e5ller k\u00e4nda s\u00e5rbarheter. I genomsnitt f\u00f6r alla repositories utg\u00f6r andelen nedladdningar av gamla versioner av paket som klassificeras som riskabla (t.ex. med ofixade s\u00e5rbarheter) 20% (i 80% av fallen laddas den aktuella versionen ner). I 96% av fallen kunde nedladdningar av komponenter med s\u00e5rbarheter undvikas genom att v\u00e4lja versioner d\u00e4r problemet redan \u00e5tg\u00e4rdats. <\/p>\n
A significant challenge in maintaining security is the quality of project support. In ecosystems for Java and JavaScript, this is a major issue \u2014 over the past year, support for one in five projects (18.6%) listed in Maven Central and NPM, and previously supported, has been discontinued. Of the 1.176 million analyzed projects present in Maven, NPM, PyPl, and Nuget repositories, only 11% (118,000) continue to be actively maintained. <\/p>\n
As part of the study, a survey was conducted among 621 professional developers from various companies. 67% of respondents believe that their applications do not use vulnerable libraries, 10% have encountered security incidents in the last 12 months caused by vulnerabilities in open source, and 20% are unsure. 28% of companies identify the presence of vulnerable components within 1 day of vulnerability disclosure, 39% \u2014 from 1 to 7 days, and 29% \u2014 over a week. \n K\u00e4lla: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"Utv\u00e4rdering](\"\/wp-content\/uploads\/2023\/10\/51959a6d676e0ad5ee98884567dd49ec.png\")
<\/center> <\/p>\n