{"id":16272,"date":"2020-05-28T13:00:00","date_gmt":"2020-05-28T13:00:00","guid":{"rendered":"https:\/\/icrowdnewswire.com\/?p=2573089"},"modified":"2020-05-28T13:00:00","modified_gmt":"2020-05-28T13:00:00","slug":"flaws-lurking-in-open-source-code-may-lead-to-a-new-heartbleed","status":"publish","type":"post","link":"https:\/\/ipsnews.net\/business\/2020\/05\/28\/flaws-lurking-in-open-source-code-may-lead-to-a-new-heartbleed\/","title":{"rendered":"Flaws lurking in open source code may lead to a new Heartbleed"},"content":{"rendered":"<p><strong>70 percent of applications contain open source security flaws.<\/strong><\/p>\n<p>Application security testing provider&nbsp;<a class=\"hawk-link-parsed\" href=\"https:\/\/www.techradar.com\/news\/sophos-sold-in-dollar39bn-deal\" data-dimension73=\"1293058804429679600\" data-component-tracked=\"1\">Veracode<\/a>&nbsp;has discovered that after an initial scan, seven in ten applications contain a security flaw in an open source library.<\/p>\n<p>The company&#8217;s new research highlights how using&nbsp;<a class=\"hawk-link-parsed\" href=\"https:\/\/www.techradar.com\/news\/open-source-the-secret-sauce-to-business-success\" data-dimension73=\"9559935663381154000\" data-component-tracked=\"1\">open source<\/a>&nbsp;can introduce flaws, increase risk and add to security debt. To compile its new&nbsp;<a class=\"hawk-link-parsed\" href=\"https:\/\/info.veracode.com\/report-state-of-software-security-open-source-edition.html\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" data-original-href=\"https:\/\/info.veracode.com\/report-state-of-software-security-open-source-edition.html\" data-component-tracked=\"1\">State of Software Security (SOSS): Open Source Edition<\/a>&nbsp;report, Veracode analyzed the component open source libraries across its platform database of 85,000 applications which account for 351,000 unique external libraries.<\/p>\n<aside class=\"hawk-widget\" data-render-type=\"fte\" data-skip=\"dealsy\" data-widget-type=\"seasonal\"><\/aside>\n<p>Almost all modern applications and even those that are sold commercially are built using some open source components. However, a single flaw in one library will cascade to all applications that leverage that code. In a&nbsp;<a class=\"hawk-link-parsed\" href=\"https:\/\/www.veracode.com\/new-research-reveals-70-applications-have-open-source-security-flaws\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" data-original-href=\"https:\/\/www.veracode.com\/new-research-reveals-70-applications-have-open-source-security-flaws\" data-component-tracked=\"1\">press release<\/a>, chief research officer at Veracode, Chris Eng explained how using open source libraries can expand an application&#8217;s attack surface, saying:<\/p>\n<p>&ldquo;Open source software has a surprising variety of flaws. An application&rsquo;s attack surface is not limited to its own code and the code of explicitly included libraries, because those libraries have their own dependencies. In reality, developers are introducing much more code, but if they are aware and apply fixes appropriately, they can reduce risk exposure.&rdquo;<\/p>\n<h2 id=\"open-source-libraries\">Open source libraries<\/h2>\n<p>According to Veracode, commonly included libraries are present in over 75 percent of applications for each programming language. The company&#8217;s research also found that flawed libraries end up in code indirectly as 47 percent of them found in applications are transitive and not pulled in directly by developers but by upstream libraries.<\/p>\n<p>Thankfully though, library-introduced flaws in most applications can be fixed with only a minor version update as major library upgrades are not usually required. However, developers can&#8217;t rely on CVEs (Common Vulnerabilities and Exposures) to understand library flaws as not all libraries have them. For example, more than 61 percent of flawed libraries in&nbsp;<a class=\"hawk-link-parsed\" href=\"https:\/\/www.techradar.com\/news\/the-openjs-foundation-aims-to-be-the-home-of-all-javascript-development\" data-dimension73=\"2074328549265959200\" data-component-tracked=\"1\">JavaScript<\/a>&nbsp;don&#8217;t have corresponding CVEs.<\/p>\n<p>The report also revealed that some programming language ecosystems tend to pull in many more transitive dependencies than others. In more than 80 percent of JavaScript, Ruby and PHP applications, the majority of libraries are transitive dependencies.<\/p>\n<p><a class=\"hawk-link-parsed\" href=\"https:\/\/www.techradar.com\/news\/software-programming-languages-which-is-best-for-your-next-project\" data-dimension73=\"1033965988192235500\" data-component-tracked=\"1\">Programming language<\/a>&nbsp;selection also plays a factor in both terms of the size of the ecosystem and in the prevalence of flaws in those ecosystems. For instance, including any given PHP library has a greater than 50 percent chance of bringing a security flaw along with it.<\/p>\n<p>Of the&nbsp;<a class=\"hawk-link-parsed\" href=\"https:\/\/owasp.org\/www-project-top-ten\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" data-original-href=\"https:\/\/owasp.org\/www-project-top-ten\/\" data-component-tracked=\"1\">OWASP Top Ten<\/a>&nbsp;flaws, weaknesses around access control are the most common and represent over 25 percent of all flaws. Cross-Site Scripting (<a class=\"hawk-link-parsed\" href=\"https:\/\/www.techradar.com\/news\/internet\/how-cross-site-scripting-attacks-work-1046844\" data-dimension73=\"1098457310075710200\" data-component-tracked=\"1\">XSS<\/a>) is the most common vulnerability category found in open source libraries (30%) followed by insecure deserialization (23.5%) and broken access control (20.3%).<\/p>\n<p class=\"tags\">\n<div><strong>See Campaign: <\/strong><a href=\"https:\/\/www.techradar.com\/news\/open-source-the-secret-sauce-to-business-success\" target=\"_blank\">https:\/\/www.techradar.com\/news\/open-source-the-secret-sauce-to-business-success<\/a><br \/><b>Contact Information:<\/b><br \/>Anthony Spadafora<\/p>\n<p><b>Tags:<\/b><br \/><a href=\"\"><\/a>, <a href=\"https:\/\/icrowdnewswire.com\/category\/news-category\/wire\/\" rel=\"category tag\">Wire<\/a>, <a href=\"https:\/\/icrowdnewswire.com\/category\/global-regions\/united-states\/\" rel=\"category tag\">United States<\/a>, <a href=\"https:\/\/icrowdnewswire.com\/category\/language\/english\/\" rel=\"category tag\">English<\/a><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"\" alt=\"image\" width=\"400\" height=\"300\" class=\"cwdfimg\" \/><\/div>\n<div>\n<h3>Contact Information:<\/h3>\n<p>Anthony Spadafora<\/p>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"<p>70 percent of applications contain open source security flaws. Application security testing provider&nbsp;Veracode&nbsp;has discovered that after an initial scan, seven in ten applications contain a security flaw in an open source library. The company&rsquo;s new research highlights how using&nbsp;open source&nbsp;can introduce flaws, increase risk and add to security debt. To compile its new&nbsp;State of Software &hellip; <a href=\"https:\/\/icrowdnewswire.com\/2020\/05\/28\/flaws-lurking-in-open-source-code-may-lead-to-a-new-heartbleed\/\">Continue reading <span>Flaws lurking in open source code may lead to a new Heartbleed<\/span><\/a> <a href=\"https:\/\/ipsnews.net\/business\/2020\/05\/28\/flaws-lurking-in-open-source-code-may-lead-to-a-new-heartbleed\/\" class=\"more-link\">Continue Reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":106,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,22,54],"tags":[],"class_list":["post-16272","post","type-post","status-publish","format-standard","hentry","category-english","category-united-states","category-wire"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v24.9 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Flaws lurking in open source code may lead to a new Heartbleed - Business<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"http:\/\/ipsnews.net\/business\/2020\/05\/28\/flaws-lurking-in-open-source-code-may-lead-to-a-new-heartbleed\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Flaws lurking in open source code may lead to a new Heartbleed - Business\" \/>\n<meta property=\"og:description\" content=\"70 percent of applications contain open source security flaws. Application security testing provider&nbsp;Veracode&nbsp;has discovered that after an initial scan, seven in ten applications contain a security flaw in an open source library. The company&rsquo;s new research highlights how using&nbsp;open source&nbsp;can introduce flaws, increase risk and add to security debt. To compile its new&nbsp;State of Software &hellip; Continue reading Flaws lurking in open source code may lead to a new Heartbleed Continue Reading &rarr;\" \/>\n<meta property=\"og:url\" content=\"http:\/\/ipsnews.net\/business\/2020\/05\/28\/flaws-lurking-in-open-source-code-may-lead-to-a-new-heartbleed\/\" \/>\n<meta property=\"og:site_name\" content=\"Business\" \/>\n<meta property=\"article:published_time\" content=\"2020-05-28T13:00:00+00:00\" \/>\n<meta name=\"author\" content=\"Waqas Awan\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Waqas Awan\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"http:\/\/ipsnews.net\/business\/2020\/05\/28\/flaws-lurking-in-open-source-code-may-lead-to-a-new-heartbleed\/\",\"url\":\"http:\/\/ipsnews.net\/business\/2020\/05\/28\/flaws-lurking-in-open-source-code-may-lead-to-a-new-heartbleed\/\",\"name\":\"Flaws lurking in open source code may lead to a new Heartbleed - Business\",\"isPartOf\":{\"@id\":\"https:\/\/ipsnews.net\/business\/#website\"},\"datePublished\":\"2020-05-28T13:00:00+00:00\",\"author\":{\"@id\":\"https:\/\/ipsnews.net\/business\/#\/schema\/person\/46e7a3c31ebaa3d111acaa0daf39976f\"},\"breadcrumb\":{\"@id\":\"http:\/\/ipsnews.net\/business\/2020\/05\/28\/flaws-lurking-in-open-source-code-may-lead-to-a-new-heartbleed\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"http:\/\/ipsnews.net\/business\/2020\/05\/28\/flaws-lurking-in-open-source-code-may-lead-to-a-new-heartbleed\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"http:\/\/ipsnews.net\/business\/2020\/05\/28\/flaws-lurking-in-open-source-code-may-lead-to-a-new-heartbleed\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/ipsnews.net\/business\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Flaws lurking in open source code may lead to a new Heartbleed\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/ipsnews.net\/business\/#website\",\"url\":\"https:\/\/ipsnews.net\/business\/\",\"name\":\"Business\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/ipsnews.net\/business\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/ipsnews.net\/business\/#\/schema\/person\/46e7a3c31ebaa3d111acaa0daf39976f\",\"name\":\"Waqas Awan\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/ipsnews.net\/business\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/3453ff882f8bf8f7e605d09dc0750c5759cb895a2d09c18a38d07b424e7f6a29?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/3453ff882f8bf8f7e605d09dc0750c5759cb895a2d09c18a38d07b424e7f6a29?s=96&d=mm&r=g\",\"caption\":\"Waqas Awan\"},\"sameAs\":[\"https:\/\/icrowdnewswire.com\/fc\"],\"url\":\"https:\/\/ipsnews.net\/business\/author\/waqas-awan\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Flaws lurking in open source code may lead to a new Heartbleed - Business","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"http:\/\/ipsnews.net\/business\/2020\/05\/28\/flaws-lurking-in-open-source-code-may-lead-to-a-new-heartbleed\/","og_locale":"en_US","og_type":"article","og_title":"Flaws lurking in open source code may lead to a new Heartbleed - Business","og_description":"70 percent of applications contain open source security flaws. Application security testing provider&nbsp;Veracode&nbsp;has discovered that after an initial scan, seven in ten applications contain a security flaw in an open source library. The company&rsquo;s new research highlights how using&nbsp;open source&nbsp;can introduce flaws, increase risk and add to security debt. To compile its new&nbsp;State of Software &hellip; Continue reading Flaws lurking in open source code may lead to a new Heartbleed Continue Reading &rarr;","og_url":"http:\/\/ipsnews.net\/business\/2020\/05\/28\/flaws-lurking-in-open-source-code-may-lead-to-a-new-heartbleed\/","og_site_name":"Business","article_published_time":"2020-05-28T13:00:00+00:00","author":"Waqas Awan","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Waqas Awan","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"http:\/\/ipsnews.net\/business\/2020\/05\/28\/flaws-lurking-in-open-source-code-may-lead-to-a-new-heartbleed\/","url":"http:\/\/ipsnews.net\/business\/2020\/05\/28\/flaws-lurking-in-open-source-code-may-lead-to-a-new-heartbleed\/","name":"Flaws lurking in open source code may lead to a new Heartbleed - Business","isPartOf":{"@id":"https:\/\/ipsnews.net\/business\/#website"},"datePublished":"2020-05-28T13:00:00+00:00","author":{"@id":"https:\/\/ipsnews.net\/business\/#\/schema\/person\/46e7a3c31ebaa3d111acaa0daf39976f"},"breadcrumb":{"@id":"http:\/\/ipsnews.net\/business\/2020\/05\/28\/flaws-lurking-in-open-source-code-may-lead-to-a-new-heartbleed\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["http:\/\/ipsnews.net\/business\/2020\/05\/28\/flaws-lurking-in-open-source-code-may-lead-to-a-new-heartbleed\/"]}]},{"@type":"BreadcrumbList","@id":"http:\/\/ipsnews.net\/business\/2020\/05\/28\/flaws-lurking-in-open-source-code-may-lead-to-a-new-heartbleed\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/ipsnews.net\/business\/"},{"@type":"ListItem","position":2,"name":"Flaws lurking in open source code may lead to a new Heartbleed"}]},{"@type":"WebSite","@id":"https:\/\/ipsnews.net\/business\/#website","url":"https:\/\/ipsnews.net\/business\/","name":"Business","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/ipsnews.net\/business\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/ipsnews.net\/business\/#\/schema\/person\/46e7a3c31ebaa3d111acaa0daf39976f","name":"Waqas Awan","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/ipsnews.net\/business\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/3453ff882f8bf8f7e605d09dc0750c5759cb895a2d09c18a38d07b424e7f6a29?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/3453ff882f8bf8f7e605d09dc0750c5759cb895a2d09c18a38d07b424e7f6a29?s=96&d=mm&r=g","caption":"Waqas Awan"},"sameAs":["https:\/\/icrowdnewswire.com\/fc"],"url":"https:\/\/ipsnews.net\/business\/author\/waqas-awan\/"}]}},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/ipsnews.net\/business\/wp-json\/wp\/v2\/posts\/16272","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ipsnews.net\/business\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ipsnews.net\/business\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ipsnews.net\/business\/wp-json\/wp\/v2\/users\/106"}],"replies":[{"embeddable":true,"href":"https:\/\/ipsnews.net\/business\/wp-json\/wp\/v2\/comments?post=16272"}],"version-history":[{"count":1,"href":"https:\/\/ipsnews.net\/business\/wp-json\/wp\/v2\/posts\/16272\/revisions"}],"predecessor-version":[{"id":16273,"href":"https:\/\/ipsnews.net\/business\/wp-json\/wp\/v2\/posts\/16272\/revisions\/16273"}],"wp:attachment":[{"href":"https:\/\/ipsnews.net\/business\/wp-json\/wp\/v2\/media?parent=16272"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ipsnews.net\/business\/wp-json\/wp\/v2\/categories?post=16272"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ipsnews.net\/business\/wp-json\/wp\/v2\/tags?post=16272"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}