On the Effect of Transitivity and Granularity on Vulnerability Propagation in the Maven Ecosystem

Amir M. Mir*, Mehdi Keshani, Sebastian Proksch

*Corresponding author for this work

Research output: Chapter in Book/Conference proceedings/Edited volumeConference contributionScientificpeer-review

1 Citation (Scopus)
24 Downloads (Pure)

Abstract

Reusing software libraries is a pillar of modern software engineering. In 2022, the average Java application depends on 40 third-party libraries. Relying on such libraries exposes a project to potential vulnerabilities and may put an application and its users at risk. Unfortunately, research on software ecosystems has shown that the number of projects that are affected by such vulnerabilities is rising. Previous investigations usually reason about dependencies on the dependency level, but we believe that this highly inflates the actual number of affected projects. In this work, we study the effect of transitivity and granularity on vulnerability propagation in the Maven ecosystem. In our research methodology, we gather a large dataset of 3M recent Maven packages. We obtain the full transitive set of dependencies for this dataset, construct whole-program call graphs, and perform reachability analysis. This approach allows us to identify Maven packages that are actually affected by using vulnerable dependencies. Our empirical results show that: (1) about 1/3 of packages in our dataset are identified as vulnerable if and only if all the transitive dependencies are considered. (2) less than 1% of packages have a reachable call path to vulnerable code in their dependencies, which is far lower than that of a naive dependency-based analysis. (3) limiting the depth of the resolved dependency tree might be a useful technique to reduce computation time for expensive fine-grained (vulnerability) analysis. We discuss the implications of our work and provide actionable insights for researchers and practitioners.
Original languageEnglish
Title of host publicationProceedings of the 2023 IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER)
EditorsCristina Ceballos
Place of PublicationPiscataway
PublisherIEEE
Pages201-211
Number of pages11
ISBN (Electronic)978-1-6654-5278-6
ISBN (Print)978-1-6654-5279-3
DOIs
Publication statusPublished - 2023
Event2023 IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER) - Taipa, Macao
Duration: 21 Mar 202324 Mar 2023

Conference

Conference2023 IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER)
Country/TerritoryMacao
City Taipa
Period21/03/2324/03/23

Bibliographical note

Green Open Access added to TU Delft Institutional Repository 'You share, we take care!' - Taverne project https://www.openaccess.nl/en/you-share-we-take-care
Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public.

Keywords

  • software vulnerabilities
  • Maven
  • fine-grained analysis
  • software ecosystem

Fingerprint

Dive into the research topics of 'On the Effect of Transitivity and Granularity on Vulnerability Propagation in the Maven Ecosystem'. Together they form a unique fingerprint.

Cite this