November 2017 Summaries

The State of Open Source Security report reveals that 77% of websites use vulnerable JavaScript libraries, with jQuery being the most commonly found library to be carrying known security vulnerabilities, affecting 92.5% of its versions in production. The majority of these vulnerable sites carry more than one known vulnerability, and six out of the top ten libraries have versions available that do not carry these vulnerabilities, but are still in use due to lack of updates. The report highlights the need for improved tooling adoption, increased awareness, and better package management workflows to address this issue and make the web more secure.

The 2017 State of Open Source Security Report provides an overview of the current state of open source security, highlighting trends in vulnerabilities across packages and container images. The report is based on data from a survey of over 500 open-source users and maintainers, as well as internal data from Snyk and information from Red Hat Linux and GitHub repositories. It reveals that open source library vulnerabilities increased by 53.8% in 2016, while the median time from vulnerability creation to disclosure is 2.5 years, with a fix being released in just 16 days. The report also shows that 79.5% of sites tested run at least one client-side JavaScript library with a known security vulnerability, and that 77% of tested sites have at least one publicly disclosed vulnerability. Overall, the report emphasizes the importance of securing open source and encourages all stakeholders to take steps to improve their security posture.

Vulnerabilities are not inherently dangerous, and their exposure is often a matter of priority. However, unaddressed vulnerabilities can add fragility to an application, making it more vulnerable to exploitation. It's essential to prioritize both exposed and unexposed vulnerabilities to ensure the security of a system. Addressing known but unexposed vulnerabilities promptly allows developers to stay proactive in securing their applications, thereby reducing the risk of potential attacks.