In this iteration of the OWASP top 10 application security vulnerabilities list (https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project), a new category 'A9 Using Components with Known Vulnerabilities' has been introduced. This appears to require the investigation of all libraries and imported code in any application to ensure compliance.
I have a number of clients who, because of their PCI-DSS audit requirements, use the OWASP top 10 to ensure the security of their own software platforms for those portions of their code base written to process credit card payments. With this new set of requirements it would appear that they would have to find/list all of their imported libraries (Perl modules from CPAN in one instance, and Java libs in another) and go through them line by line - probably a million lines of someone else's code!.
This can't be practical or, probably, very useful! Can OWASP seriously be suggesting that those organisations that write their own applications, importing common libraries, have to review all third-party library code?
Has anyone else come across this problem, and how do you think I can deal with this?