Open Source Vulnerabilities News Today

Announcing Google Cloud’s new Assured Open Source Software Service, which can help organizations add the same software that Google uses into their own workflows.

With the two new services, Google aims to help minimise risk from malicious code in the software supply chain.

With the two new services, Google aims to help minimize risk from malicious code in the software supply chain.

OSV-Scanner is a free vulnerability scanner that open source developers can use to check for vulnerabilities in their projects' dependencies.

SBOMs should be connected with vulnerability databases to fulfill their promise of reducing risk, Google security team says.

Recent vulnerabilities such as Log4j2 have called attention to the challenges of securing open-source software, which is used widely by tech companies and other industry enterprises. Google will release the security-vetted versions of open source software packages that it runs itself for industry and government use.

Organizations using open-source software aren’t necessarily placing themselves at greater security risk, but the key to a successful, safe implementation of open-source software is a thorough management strategy.

The GitHub Advisory Database is now open to community contributions to help further the security of open source software.

The world of open source security is fast moving, with new vulnerabilities and different attack vectors driving the community to continuously (...)

Researchers, academics, and enthusiasts can now contribute to and benefit from free, open-source security data on software supply chain vulnerabilities.