December 2022 Summaries

The text discusses the challenges and risks associated with software dependency management, particularly focusing on the difficulties faced by both library users and maintainers in tracking updates, ensuring compatibility, and managing security vulnerabilities. It highlights significant events like the SolarWinds and Log4J compromises that underscored the need for improved security measures in the software supply chain. The text introduces the concept of using call graphs—both static and dynamic—as a way to provide more precise dependency analysis, enabling developers to better understand which parts of a dependency are actually in use and assess the impact of changes. Endor Labs advocates for using static call graphs to perform fine-grained dependency analysis, arguing that this approach offers a minimally intrusive yet comprehensive method for understanding security and operational risks. The text also notes the complexity and potential inaccuracies of call graphs but emphasizes their value in helping security teams prioritize efforts and resources effectively, despite the inherent challenges of managing a constantly evolving landscape of software vulnerabilities.

The software industry is grappling with significant security challenges stemming from vulnerabilities in open source components and supply chain attacks, exemplified by incidents like Log4Shell and protestware. Addressing these issues requires a comprehensive understanding of dependency management, as highlighted by initiatives such as the Census II report and OpenSSF Criticality Score, which aim to identify critical open source projects but often yield differing results. Despite efforts from organizations like OpenSSF, CNCF, and OWASP to improve security through best practices and tooling, the responsibility largely falls on open source software consumers to assess and address security risks based on their specific contexts. Dependency complexities, characterized by intricate direct and transitive relationships, further complicate security efforts, with a significant portion of vulnerabilities residing in transitive dependencies. The challenge is exacerbated by the fact that many vulnerabilities may not be exploitable, necessitating a focus on reachability and timely updates. However, updates can introduce breaking changes, and not all vulnerabilities are immediately patchable, underscoring the need for program analysis throughout the dependency lifecycle to better understand code usage and enhance security decision-making.

Endor Labs emphasizes the importance of static analysis when prioritizing vulnerabilities in software projects, highlighting the limitations of relying solely on metadata analysis and the extensive manual effort required to assess security or performance issues. The discussion is set against the backdrop of the BlackHat 2026 event in Las Vegas and includes related topics such as dependency management, alert fatigue from noisy security tools, and program analysis for software composition analysis (SCA). Joseph Hejderup authored the piece, which was published in December 2022 and updated in August 2025, also touching upon related subjects like the role of AppSec professionals in modern Java communities, the risks of unvetted AI models in codebases, and tools like Endor Labs' Vulnerability Search that enhance the investigation of Common Vulnerabilities and Exposures (CVEs) through enriched metadata and precise impact analysis.