Report: Open source software plagued with vulnerabilities

The adoption of open source software and components has permeated almost every aspect of technology, but the number of vulnerabilities per commercial codebase are increasing at almost the same rate – and even cybersecurity applications are at risk.

The Black Duck by Synopsys 2018 Open source Security and Risk Analysis (OSSRA) report scanned more than 1100 commercial codebases across industries including automotive, big data, cybersecurity, IoT, mobile apps, financial services, manufacturing, healthcare, and enterprise software.

"Since modern software and infrastructure depend heavily on open source technologies, having a clear view of components in use is a key part of corporate governance," says Black Duck by Synopsys technical evangelist Tim Mackey.

The report found that 96% of the scanned applications contained open source components, with an average of 257 components per codebase.

While the number of components per codebase has increased 75% over the previous year, more codebanks often contain more open source than proprietary code.

In addition, 78% of the examined codebases contained at least one open source vulnerability, with an average of 64 vulnerabilities per codebase.

The report says that 54% of the vulnerabilities found are considered high-risk vulnerabilities. Furthermore, 17% contained highly-publicised vulnerabilities like Heartbleed, Poodle, Drown, Freak, and Logjam.

"The report clearly demonstrates that with the growth in open source use, organisations need to ensure they have the tools to detect vulnerabilities in open source components and manage whatever license compliance their use of open source may require," Mackey continues.

The internet and software infrastructure vertical is the most at-risk: 67% of applications contained high-risk open source vulnerabilities.

The cybersecurity vertical was also heavily affected – 41% of applications have high-risk open source vulnerabilities.

The report also offers insights into the Equifax breach, which was compromised through Apache Struts.

Overall, 33% of the audited codebases that contained Apache Struts also contained the vulnerability that caused the Equifax breach.  On average, identified vulnerabilities in the report's audit were disclosed almost six years ago.

"When Equifax was breached through the Apache Struts vulnerability, the need for open source security management became front-page news," says Black Duck product marketing manager responsible for the OSSRA report, Evan Klein.

"Yet even though it was disclosed in March 2017, many organisations apparently still have not checked their applications for the Struts vulnerability."

The report also found that 74% of the codebases audited also contained components with license conflicts, the most common of which were GPL license violations.

The percentage of applications with license conflicts within verticals ranged from the retail and eCommerce industry's relative low of 61% to the high of the telecommunications and wireless industry—where 100% of the code scanned had some form of open source license conflict.