How to keep an eye on upgrades, patches and security issues for used open-source libraries?

Question

For a project with many open-source libraries as a part of it, I began to search for information source concerning all upgrades and security issues. The kind of sources I gathered are either announcement list or issue/bug tracker in the form of RSS feeds or Mailing List, as either could be retrieved and parsed in a way or another, and then gathered in one place.

The problem is, for a third of those libraries, none of this is available. So I was wondering, aside from RSS/Atom feeds or Mailing List is there any other parsable sources I should be tracking?

EDIT:

We've recently started to make an audit manually, trying to list the known vulnerabilities of the open source libraries we use. For that it was decided to use security advisory sites such as Secunia, Vupen, and NVD, as the information is generally formatted in a relevant way. However we want to automate the process in the future.

Would parsing such sites be easier and/or bring more relevant information when compared to other sources? I know for a fact that Secunia doesn't take so kindly that a script sniff on their sites, and wondered if it would be the case for other security advisories, or if such hurdle could be encountered with other kind of sources.

Answer 1

The Open Source Vulnerability Database (http://osvdb.org/) is useful. See also the answers to this question

If the libraries are among the tens of thousands of Ubuntu packages, the Ubuntu CVE tracker provides good information:

http://people.canonical.com/~ubuntu-security/cve/

The code to parse the Mitre CVE database and the NVD (National Vulnerability Database) for new vulnerabilities and track security issues is at https://launchpad.net/ubuntu-cve-tracker

You can see the README and browse the code and parsed CVEs at

http://bazaar.launchpad.net/~ubuntu-security/ubuntu-cve-tracker/master/files

and you can easily follow it with the open-source "bzr" distributed source control system.

Security and packaging problems are unusually complicated for Java as discussed at http://fnords.wordpress.com/2010/09/24/the-real-problem-with-java-in-linux-distros/

Answer 2

For some subset of the missing third, you can subscribe to the project on Freecode (formerly known as "Freshmeat").

You may also find the Security page and Vulnerability database at Linux Weekly News useful. (And if you do, I highly recommend subscribing to LWN, which is a very valuable information source for Linux and open source in general, and not backed by any large, wealthy company.)

Answer 3

One other way to deal with this is to checkout libraries directly from their official source code repository and do updates once in while. Easier than always downloading and easy to revert.

Answer 4

Your assessment may be expressable in an OVAL tool.

Answer 5

If you're a developer NuGet (formerly NuPack) is software on codeplex that automates the managment of 3rd party libraries in your application.

http://nuget.codeplex.com/

All the packages are maintained here:

http://nupackpackages.codeplex.com/

If you know of any software projects (or write one yourself) that can be incorporated into a "Windows Update" of sorts that allows for IT to monitor and manage the patch list for FOSS software, please update this question with what you find!

Answer 6

OWASP Dependency Check checks your libs and compares to a list of known vulnerabilities. It "has a command line interface, a Maven plugin, an Ant task, and a Jenkins plugin." Or as they describe it:

Dependency-Check is a utility that identifies project dependencies and checks if there are any known, publicly disclosed, vulnerabilities. Currently Java, .NET, and Python dependencies are supported.

Answer 7

If your project is set up using Maven you can add code repositories and mirrors you want to index.

Have come this far you can then, for example, specify in your pom.xml that you want to use the latest release of a given library. Once there is a new release of that library your project wont build until you have downloaded the library into your own local repository.

For example you could use Sonatype Nexus Maven Repository to manage all your repositories. Then you could easily parse Nexus's repository viewer to find out if there have been any updates. I am unsure if Nexus has built-in RSS.