Exogenous and Endogenous Factors Leading to OSS Vulnerability: Study on Version Dependency Network

Abstract

Pursuant to many open-source software (OSS) vulnerability incidents, various research institutes and firms have attempted to either identify the most commonly used OSS components, and examine for potential vulnerabilities and possible investments, or produce tools to detect OSS vulnerabilities by thorough inspection. Although these firms aim to identify vulnerabilities as many as possible, but produce too many alarms, and many false alarms. At the same time, one of the major assumptions in various importance and security studies is that packages keep same dependencies over time, i.e., all dependencies are calculated without considering version information, however this is a wrong assumption, for instance when the gem package “spruz” is scored highly risky, because it depended on previous versions of some popular packages, “json_pure”. Having included version dependency, “spruz” would not have scored high importance. Therefore, it is important to investigate package version vulnerability rather than project vulnerability, also discuss research questions as 1) what factors could lead to package vulnerability? Also knowing these factors, can one narrow down vulnerability search? For this purpose, we build a version dependency network combining various sources; on the other hand, we collect vulnerabilities from different repositories. We investigate the impact of network exposure and other exogenous and endogenous factors such as contributors count, open issues count, version age and number of forks on latest package version vulnerability.