Google has launched a platform – OSV (Open-Source Vulnerabilities), which is a vulnerability database and triage infrastructure meant for open-source projects.
It is going to help the contributors and users of open-source software by providing precise data on vulnerabilities so that those can be worked upon as soon as possible.
The initial release of OSV only contains vulnerabilities found by OSS-Fuzz (which include mostly C/C++ Projects). Support for other language ecosystems is in the works.
How Does It Work?
OSV is all about automation, it aims to make vulnerability reporting simple by showing an accurate list of affected versions and commits to an open-source package.
It all depends on the information available, OSV requires the submission of the commits that introduced the bugs as well as the ones that fixed it.
If that information is not available then OSV requires a reproduction test case and steps to generate an application build, it will then perform a bisection to ascertain the commits in an automated manner and analyze the rest of the data to understand which commit ranges were impacted.
Don’t mind the technical jargon if you are a consumer, but it will help you know the exact details about a vulnerability and where it got fixed. So, you can easily check the package you are using and decide to update it or not.
It also automates the triage workflow of an open-source package by providing an API to search for vulnerabilities. When executed, OSV shows the set of vulnerabilities that are affecting the specified version of the package in a machine-readable JSON format. This should definitely help the project maintainers and developers.
Equipped with this information, the package user can also choose whether to get that security patch or update to a newer version altogether. Isn’t that useful?
You can read more about it in their official announcement.
Wrapping Up
Currently, OSV is being offered with access to thousands of vulnerabilities from 300+ critical OSS projects integrated with OSS-Fuzz and is being run on Google Cloud Platform (GCP).
Google has plans for extending support to various language ecosystems with the help of the open-source community and that shows, with OSV being open-source with a GitHub repository being made live and a Google Group for discussions regarding the same.
What do you think about OSV?, What are your thoughts on it? Let me know in the comments below.
More from It's FOSS...
- Learn Bash scripting for FREE with this Bash Tutorial series.
- Join our community forum.
- 📩 Stay updated with the latest on Linux and Open Source. Get our weekly Newsletter.
