Fixing Outside the Box: Uncovering Tactics for Open-Source Security Issue Management
In the rapidly evolving landscape of software development, addressing security vulnerabilities in open-source software (OSS) has become critically important. However, existing research and tools from both academia and industry mainly relied on limited solutions, such as vulnerable version adjustment and adopting patches, to handle identified vulnerabilities. However, far more flexible and diverse countermeasures have been actively adopted in the open-source communities. A holistic empirical study is needed to explore the prevalence, distribution, preferences, and effectiveness of these diverse strategies.
To this end, in this paper, we conduct a comprehensive study on the taxonomy of vulnerability remediation tactics (RT) in OSS projects and investigate their pros and cons. This study addresses this oversight by conducting a comprehensive empirical analysis of 21,187 issues from GitHub, aiming to understand the range and efficacy of remediation tactics within the OSS community. We developed a hierarchical taxonomy of 44 distinct RT and evaluated their effectiveness and costs. Our findings highlight a significant reliance on community-driven strategies, like using alternative libraries and bypassing vulnerabilities, 44% of which are currently unsupported by cutting-edge tools. Additionally, this research exposes the community’s preferences for certain fixing approaches by analyzing their acceptance and the reasons for rejection. It also underscores a critical gap in modern vulnerability databases, where 54% of CVEs lack fixing suggestions—a gap that can be significantly mitigated by leveraging the 93% of actionable solutions provided through GitHub issues.
Fri 27 JunDisplayed time zone: Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna change
11:00 - 12:05 | Empirical StudiesTool Demonstrations / Research Papers at Cosmos Hall Chair(s): Miryung Kim UCLA and Amazon Web Services | ||
11:00 25mTalk | Fixing Outside the Box: Uncovering Tactics for Open-Source Security Issue Management Research Papers Lyuye Zhang Nanyang Technological University, Wu Jiahui , Chengwei Liu Nanyang Technological University, Kaixuan Li Nanyang Technological University, Xiaoyu Sun Australian National University, Australia, Lida Zhao Nanyang Technological University, Chong Wang Nanyang Technological University, Yang Liu Nanyang Technological University DOI | ||
11:25 25mTalk | More Effective JavaScript Breaking Change Detection via Dynamic Object Relation Graph Research Papers Dezhen Kong Zhejiang University, Jiakun Liu Singapore Management University, Chao Ni Zhejiang University, David Lo Singapore Management University, Lingfeng Bao Zhejiang University DOI | ||
11:50 15mDemonstration | LiPSBOMaker: A Prototype of Multi-Stage Linux Distribution Package SBOM Generator Tool Demonstrations Tong Qiu , Jiaxin Zhu Institute of Software at Chinese Academy of Sciences, Wei Chen Institute of Software at Chinese Academy of Sciences, Jun Wei Institute of Software at Chinese Academy of Sciences; University of Chinese Academy of Sciences | ||
This is the main event hall of Clarion Hotel, which will be used to host keynote talks and other plenary sessions. The FSE and ISSTA banquets will also happen in this room.
The room is just in front of the registration desk, on the other side of the main conference area. The two large doors with numbers “1” and “2” provide access to the Cosmos Hall.