OSS 2019
Sun 26 - Mon 27 May 2019 Montreal, QC, Canada
co-located with ICSE 2019
Mon 27 May 2019 14:30 - 14:45 at Mansfield - Practitioners Session 2

The use of third-party libraries to manage software complexity can expose open source software projects to vulnerabilities. However, project owners do not currently have a standard way to enable private disclosure of potential security vulnerabilities. This neglect may be caused in part by having no template to follow for disclosing such vulnerabilities. We analyzed 600 GitHub projects to determine how many projects contained a vulnerable dependency and whether the projects had a process in place to privately communicate security issues. We found that 385 out of 600 open source Java projects contained at least one vulnerable dependency, and only 13 of those 385 projects had a security vulnerability reporting process. That is, 96.6% of the projects with a vulnerability did not have a security noti fication process in place to allow for private disclosure. In determining whether the projects even had contact information publicly available, we found that 19.8% had no contact information publicly available, let alone a security vulnerability reporting process. We suggest two methods to allow for community members to privately disclose potential security vulnerabilities.

Mon 27 May

oss2019-papers
14:00 - 14:45: OSS 2019 Papers - Practitioners Session 2 at Mansfield
oss2019-papers14:00 - 14:15
Experience report
Matthias MüllerInstitute of Software Technology, Graz University of Technology , Christian SchindlerInstitute of Software Technology, Graz University of Technology , Wolfgang SlanyInstitute of Software Technology, Graz University of Technology
oss2019-papers14:15 - 14:30
Experience report
Sebastian SchorkCAS Software AG, Karlsruhe, Germany, Feroz ZahidSimula Research Laboratory, Norway, Dipesh PradhanSimula Research Laboratory, Norway, Sébastien KicinCAS Software AG, Karlsruhe, Germany, Antonia SchwichtenbergCAS Software AG, Karlsruhe, Germany
oss2019-papers14:30 - 14:45
Experience report
Brandon CarlsonUniversity of Illinois at Urbana-Champaign, USA, Kevin LeachUniversity of Michigan, Darko MarinovUniversity of Illinois at Urbana-Champaign, Mei NagappanUniversity of Waterloo, Atul PrakashUniversity of Michigan