Keynote: What Log4j teaches us about the Software Supply Chain
No ratings
Presented at High Confidence Software and Systems Conference 2022 by
In December of 2021, exploit code for a high-severity zero-day vulnerability was released on GitHub. The exploit targeted a vulnerability in the default configuration of the widely-used log4j library and resulted in many open source and commercial codebases becoming instantly vulnerable. Attacks started immediately and vendors rushed to communicate their vulnerability status and remediation plans to customers. The resulting industry-wide remediation efforts provide insight into the current state of software supply chain tooling and processes. The results show a stark contrast between companies and projects that have prioritized monitoring and assurance of their supply chains and those that have not. It also highlights the challenges that industry and open source both face when it comes to rapid remediation of vulnerabilities in open source software. Long transitive dependency chains delay full remediation. Unstable APIs add work to software patching tasks. And malicious open source commits make it risky to automate adoption of the latest library versions. As the maintainer of Maven Central - the repository that hosts log4j and most other open source Java projects - Sonatype has unique insight into the uptake of patched versions of vulnerable components. This presentation will draw on analysis of this data to discuss behavioral patterns in open source supply chain management. For example, even 2 months after the disclosure of the log4j vulnerability, about 40% of Maven Central log4j download requests are still pulling vulnerable versions. Sonatype also works closely with enterprises to help them manage their software supply chains, and we will share our observations regarding industry trends and challenges. Many of these observations are based on a survey of industry approaches to supply chain management that we have been conducting annually for the last three years. This talk will pull together the above content into a presentation targeted at the HCSS community. The goals will be covering relevant background information, providing a summary of the state of the art with respect to industry tooling, and highlighting the open challenges that could benefit from further research and technology development.