OPEN SOURCE SECURITY AND RISK ANALYSIS REPORT

The annual “Open Source Security and Risk Analysis” (OSSRA) report, now in its 8^th edition, examines vulnerabilities and license conflicts found in roughly 1,700 codebases across 17 industries. The report offers recommendations for security, legal, risk, and development teams to better understand the security and risk landscape accompanying open source development and use.

OPEN SOURCE IS EVERYWHERE

Open source continues to prove its staying power, serving as the foundation for the vast majority of commercial codebases. In fact, it’s so intertwined in modern development that code owners often don’t know the open source components in their own software.

SECURITY RISK IS PREVALENT

The overall percentage of codebases containing security vulnerabilities remains troublingly high. After a year of modest progress, there was another slight uptick (4%) in vulnerabilities during 2022. 

While overall vulnerabilities were slightly up, the percentage of codebases with high-risk vulnerabilities was down 2% from last year, to 48%. Also promising was fewer instances of Log4J, which was found in 11% of audited Java codebases this year, down from 15%. While an improvement, this points to a larger trend of organizations failing to implement patches.

OPERATIONAL RISK IS PERVASIVE

A worrying number of codebases contained open source that had no development activity and no user updates in the last two years. When no feature upgrades, code improvements, or security remediation occurs for 24 months, it’s likely the project is no longer being maintained at all.

KEY INDUSTRIES REMAIN VULNERABLE

The same story emerged across all industry sectors: Open source was present in almost every codebase, composed the majority of the total codebases, and was vulnerable to exploit and attack. Only a comprehensive inventory of all software in use by an organization can help mitigate this business risk.