A plan to sort out this CVE mess

Be it in India, Europe or the US, vulnerability management for open source packages is an imperative. And right when we need it most, the CVE ecosystem is falling apart, a problem made ever more critical with AI-mediated attacks on the open source software supply chain. Let’s look at the problems, the solutions elements and walk through a concrete plan towards making vulnerability management a straight forward process because we feed it with correct, open, current, quality data about open source package security bugs, and their fixes, beyond CVE.

The CERT-in, the EU Cyber Resilience Act, and similar regulation across the world are emerging and making vulnerability management a mandatory practice, with key processing deadlines (like within 24h). These processes are only possible with correct, current data about which of the thousand packages used in a software product may be vulnerable, and if this vulnerability is reachable or exploitable. The traditional CVE ecosystem is falling apart and no longer able to solely provide the much needed data input. The takeaway is an understanding of the vulnerability data landscape, its strengths and weaknesses and a plan on how to help fix the data problem, the open source way, together with an overview of existing FOSS tools that will benefit from this initiative.