The Extent of Orphan Vulnerabilities from Code Reuse in Open Source Software

David Reid, Mahmoud Jahanshahi, Audris Mockus

Abstract

Motivation: A key premise of open source software is the ability to copy code to other open source projects (white-box reuse). Such copying accelerates development of new projects, but the code flaws in the original projects, such as vulnerabilities, may also spread even if fixed in the projects from where the code was appropriated. The extent of the spread of vulnerabilities through code reuse, the potential impact of such spread, or avenues for mitigating risk of these secondary vulnerabilities has not been studied in the context of a nearly complete collection of open source code.

BibTeX

@inproceedings{Reid-al:ICSE22,
  author    = {David Reid and
               Mahmoud Jahanshahi and
               Audris Mockus},
  title     = {The Extent of Orphan Vulnerabilities from Code Reuse in Open Source Software},
  booktitle = {ICSE},
  pages     = {2104--2115},
  publisher = {{ACM}},
  year      = {2022},
}

The Extent of Orphan Vulnerabilities from Code Reuse in Open Source Software

Abstract

Related papers