Chi tiết CWE-1395

The product has a dependency on a third-party component that contains one or more known vulnerabilities.

Chi tiết nền tảng

Các cách xuất hiện

Architecture and Design : The product architect or designer might choose a component that is already known to contain vulnerabilities or has a high likelihood of containing vulnerabilities in the future.
Implementation : For reasons of compatibility or stability, developers might choose a third-party component, such as a library, that is already known to contain vulnerabilities.
Patching and Maintenance : Since all products contain vulnerabilities, over time, a third-party component will be discovered to have a vulnerability.

Nền tảng áp dụng

Ngôn ngữ

Lớp: Not Language-Specific (Undetermined)

Hệ điều hành

Lớp: Not OS-Specific (Undetermined)

Kiến trúc

Lớp: Not Architecture-Specific (Undetermined)

Công nghệ

Lớp: Not Technology-Specific (Undetermined)

Hậu quả phổ biến

Ví dụ đã quan sát

Các biện pháp giảm thiểu tiềm năng

Phases : Requirements // Policy
In some industries such as healthcare [REF-1320] [REF-1322] or technologies such as the cloud [REF-1321], it might be unclear about who is responsible for applying patches for third-party vulnerabilities: the vendor, the operator/customer, or a separate service. Clarifying roles and responsibilities can be important to minimize confusion or unnecessary delay when third-party vulnerabilities are disclosed.
Phases : Requirements
Require a Bill of Materials for all components and sub-components of the product. For software, require a Software Bill of Materials (SBOM) [REF-1247] [REF-1311].
Phases : Architecture and Design // Implementation // Integration // Manufacturing
Maintain a Bill of Materials for all components and sub-components of the product. For software, maintain a Software Bill of Materials (SBOM). According to [REF-1247], "An SBOM is a formal, machine-readable inventory of software components and dependencies, information about those components, and their hierarchical relationships."
Phases : Operation // Patching and Maintenance
Actively monitor when a third-party component vendor announces vulnerability patches; fix the third-party component as soon as possible; and make it easy for operators/customers to obtain and apply the patch.
Phases : Operation // Patching and Maintenance
Continuously monitor changes in each of the product's components, especially when the changes indicate new vulnerabilities, end-of-life (EOL) plans, etc.

Phương pháp phát hiện

Automated Analysis

For software, use Software Composition Analysis (SCA) tools, which automatically analyze products to identify third-party dependencies. Often, SCA tools can be used to link with known vulnerabilities in the dependencies that they detect. There are commercial and open-source alternatives, such as OWASP Dependency-Check [REF-1312]. Many languages or frameworks have package managers with similar capabilities, such as npm audit for JavaScript, pip-audit for Python, govulncheck for Go, and many others. Dynamic methods can detect loading of third-party components.
Hiệu quả : High

Ghi chú ánh xạ lỗ hổng

Lý do : This CWE entry is a Class, but it does not have Base-level children.
Bình luận : This entry is classified in a part of CWE's hierarchy that does not have sufficiently low-level coverage, which might reflect a lack of classification-oriented weakness research in the software security community. Conduct careful root cause analysis to determine the original mistake that led to this weakness. If closer analysis reveals that this weakness is appropriate, then this might be the best available CWE to use for mapping. If no other option is available, then it is acceptable to map to this CWE.

Tài liệu tham khảo

REF-1313

The Unfortunate Reality of Insecure Libraries
Jeff Williams, Arshan Dabirsiaghi.
https://owasp.org/www-project-dependency-check/

REF-1212

A06:2021 - Vulnerable and Outdated Components
https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components/

REF-1247

Framing Software Component Transparency: Establishing a Common Software Bill of Materials (SBOM)
NTIA Multistakeholder Process on Software Component Transparency Framing Working Group.
https://www.ntia.gov/files/ntia/publications/ntia_sbom_framing_2nd_edition_20211021.pdf

REF-1311

The Cases for Using the SBOMs We Build
Amélie Koran, Wendy Nather, Stewart Scott, Sara Ann Brackett.
https://www.atlanticcouncil.org/wp-content/uploads/2022/11/AC_SBOM_IB_v2-002.pdf

REF-1312

OWASP Dependency-Check
OWASP.
https://owasp.org/www-project-dependency-check/

REF-1314

ICS Alert (ICS-ALERT-20-063-01): SweynTooth Vulnerabilities
ICS-CERT.
https://www.cisa.gov/news-events/ics-alerts/ics-alert-20-063-01

REF-1315

Unleashing Mayhem over Bluetooth Low Energy
Matheus E. Garbelini, Sudipta Chattopadhyay, Chundong Wang, Singapore University of Technology and Design.
https://asset-group.github.io/disclosures/sweyntooth/

REF-1316

Alert (AA21-356A): Mitigating Log4Shell and Other Log4j-Related Vulnerabilities
CISA.
https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-356a

REF-1317

What Log4Shell taught us about application security, and how to respond now
Daniel Thomas.
https://www.scworld.com/resource/what-log4shell-taught-us-about-appsec-and-how-to-respond

REF-1320

A Framework for a Medical Device Security Program at a Healthcare Delivery Organization
Ali Youssef.
https://array.aami.org/content/news/framework-medical-device-security-program-healthcare-delivery-organization

REF-1321

Shared Responsibility Model Explained
Cloud Security Alliance.
https://cloudsecurityalliance.org/blog/2020/08/26/shared-responsibility-model-explained/

REF-1322

Medical Device Cybersecurity Regional Incident Preparedness and Response Playbook
Melissa Chase, Steven Christey Coley, Julie Connolly, Ronnie Daldos, Margie Zuk.
https://www.mitre.org/news-insights/publication/medical-device-cybersecurity-regional-incident-preparedness-and-response

Gửi

Sửa đổi