The Unfortunate Reality of Insecure Libraries presented at OWASP AppSecDC 2012

by Arshan Dabirsiaghi, Jeff Williams,

Summary : Many organizations have started application security programs to focus on finding and subsequently preventing vulnerabilities in their custom code. However, the widespread use of common libraries introduces risks that are widely ignored and unappreciated. In this study, we analyze over 113 million library downloads from the Maven Central repository of the 31 most popular Java frameworks and security libraries by over 500,000 companies. The data show that there are a surprising amount of libraries with known vulnerabilities in common use. We also conclude that most organizations do not appear to have a strong process in place for ensuring that the libraries they rely on are up-to-date and free from known vulnerabilities.