Software composition and dependency management

Reporting vulnerabilities within a complex software environment

Using the CVE-Bin-Tool
D.dependency
Anthony Harrison
<p>Detecting known software vulnerabilities is hard to do perfectly. However, the CVE Binary Tool is a tool which has been designed to analyse and trace dependencies by performing a binary analysis that attempts to detect the versions of the libraries in compiled applications in order to determine the vulnerabilities that may be present. Since the tool was initially released, the number of libraries which can be detected has steadily increased so now over 100 libraries can be detected primarily through the effort of students working under the Google Summer of Code (GSOC) programme. Supported libraries have typically been prioritised based on the number and frequency of vulnerabilities reported in the CVE database. The latest version of tool released at the end of 2021 has added capabilities to perform vulnerability scanning of Linux distros, Python applications and to consume Software Bill of Materials (both the SPDX and CycloneDX formats are supported). Further enhancements are planned in 2022.</p> <p>This presentation will describe how the tool works, how to use it in a number of use cases and show how you can contribute to further develop the capabilities of the tool.</p>

Additional information

Type devroom

More sessions

2/6/22
Software composition and dependency management
D.dependency
<p>The devroom intro by devroom organization team!</p>
2/6/22
Software composition and dependency management
Philippe Ombredanne
D.dependency
<p>Package URLs are a compact way to identify software packages across multiple ecosystems. Together with the new "vers" Version Range Specifier, these two mini specs will offer a new way to create new, mostly universal dependency resolvers and installers, working across ecosystems.</p>
2/6/22
Software composition and dependency management
Ana Jimenez Santamaria
D.dependency
<p>Legal Risk Mitigation is one of the three main functions of an <a href="https://github.com/todogroup/ospodefinition.org">OSPO</a> (designated places where open source is supported, nurtured, shared, explained, and grown inside an organization). OSPOs often oversee aspects of a company’s open source license compliance process and supply chain as one of the first activities. The responsibilities include:</p> <ul> <li>Maintaining open source license compliance reviews and oversight</li> ...
2/6/22
Software composition and dependency management
Pierre Marty
D.dependency
<p>This talk aims at presenting our trials and tribulations as well as our achievements in designing a compliance software project for open source licenses.</p> <p><em>"Are all module licenses in our software project compliant with each other ?"</em> Many of our customers have asked us this question even though they already had a plethora of software solutions (not always FOSS software) dealing with this topic. This surprised us, and led us to seek out the cause of their uncertainty. We then ...
2/6/22
Software composition and dependency management
Kouki Hama
D.dependency
<p>The management of SBoM (software bill of material) is very important for companies to comply with the OpenChain specification.The latest features of SW360 support the management of license obligations and the management of SBOMs in SPDX format. In this presentation, I will introduce and demonstrate the features of SW360.</p>
2/6/22
Software composition and dependency management
Maximilian Huber
D.dependency
<p>Granted that software composition and dependency processing are very relevant for software engineering. The presentations have pointed out how such processing is embedded into activities of an organization. We would like to gather feedback about how the current status of adoption and integration looks like.</p>
2/6/22
Software composition and dependency management
D.dependency
<p>break</p>