Navigating The Open-Source Security Fog: A Case Study Of Messy Vulnerability Data - Jamie Harris
Channel: BSides Belfast
Date: 2024-03-19

Abstract:
As an industry we heavily rely on publicly disclosed vulnerability data to manage our security risks in open-source software. Unfortunately this world can be a foggy one, full of research that is useful but not always complete or well correlated, leaving us scrambling to put all the pieces together. What can we do to clear this fog?

This talk will examine an example case of a remote code execution vulnerability in OpenTSDB that our team disclosed this year, which also had a history of loosely connected disclosures stretching over several years. We will see what lessons can be learned and how everyone, from software maintainers to security researchers, can contribute so we can better respond to security risks.

Vulnerability Analyst, Synopsys Cybersecurity Research Centre
Jamie is a vulnerability analyst who works in the Synopsys Cybersecurity Research Centre (CyRC) team part-based here in Belfast. He began his career with Synopsys in 2018 and over the past five years has written security advisories for Synopsys' Black Duck customers, researched vulnerabilities of interest and discovered new vulnerabilities in open-source software. Outside of the world of security Jamie loves gaming and following everything motorsport.