Vulnerability on OpenChain KWG

OSV-SCALIBR

Mon, 01 Jan 0001 00:00:00 +0000

OSV-SCALIBR (Open Source Vulnerabilities - Software Composition Analysis LIBRary) is an open source software composition analysis tool developed by Google. It scans filesystems, container images, and binaries to identify included packages and detects known vulnerabilities by cross-referencing the OSV (Open Source Vulnerabilities) database. It also supports SBOM generation in SPDX format.

GitHub: https://github.com/google/osv-scalibr
License: Apache-2.0

1. Features

Multiple scan targets: Local filesystem, container images, archive files
Wide ecosystem support: Go, Python, Java (Maven), JavaScript (npm), Rust, Ruby, and more
OSV DB integration: Cross-references scan results with the OSV database to provide CVE and other vulnerability information
SBOM output: Exports results in SPDX 2.3 format
CLI and library: Provided as both a standalone binary (CLI) and a Go library

2. Installation

Build with Go 1.21 or later:

Dependency-Track

Mon, 01 Jan 0001 00:00:00 +0000

Dependency-Track is an open source SBOM management and vulnerability analysis platform managed by OWASP. It continuously monitors component-level vulnerabilities based on uploaded SBOMs (CycloneDX, SPDX) and automatically evaluates policy violations.

GitHub: https://github.com/DependencyTrack/dependency-track
Official docs: https://docs.dependencytrack.org/
License: Apache-2.0

Features

SBOM-based continuous monitoring: Automatically tracks the latest vulnerabilities per component after uploading SBOMs in SPDX or CycloneDX format
Multiple vulnerability data sources: NVD, OSV, GitHub Advisories, VulnDB, and more
Policy engine: Define rules for license policies, vulnerability severity thresholds, and component allowlists for automatic evaluation
REST API: Integrate with CI/CD pipelines to automatically upload SBOMs and receive feedback at build time
Web UI dashboard: View per-project risk scores, vulnerability status, and license distribution at a glance
Notifications: Send new vulnerability alerts via Slack, email, Webhook, and other channels

Installation

Using Docker Compose is the simplest approach:

Building an Automated Open Source Management Environment: cdxgen + Dependency-Track

Mon, 01 Jan 0001 00:00:00 +0000

For companies just starting with open source management, we recommend the cdxgen + Dependency-Track combination as a toolset that can establish a basic automation environment within a single day.

This guide walks you through every step, from installation and configuration to setting up a license and vulnerability inspection environment and running day-to-day operations.

Why cdxgen + Dependency-Track

Open source management comes down to two essentials.

Know what is inside — generating an SBOM (Software Bill of Materials)
Continuously monitor risk — detecting vulnerabilities (CVEs) and license policy violations

cdxgen handles the first, and Dependency-Track handles the second. Both tools are free open source under the Apache-2.0 license.

TRUSCA

Mon, 01 Jan 0001 00:00:00 +0000

Managing the vulnerabilities and licenses of open source components calls for an SCA (Software Composition Analysis) tool. Several commercial products exist, but some organizations look for an open source tool they can install and run on their own infrastructure.

TRUSCA is a self-hosted SCA portal published for that purpose. Released under Apache 2.0, it brings vulnerabilities (CVE), license compliance, and SBOM management into a single screen. It is developed by Trusted OSS, a project that grew out of KWG community work.

§4.3.2 Security Assurance

Mon, 01 Jan 0001 00:00:00 +0000

★ 18974 Exclusive Items — Documented Evidence Strength

§4.3.2.1·§4.3.2.2 are ISO 18974 exclusive (★) items requiring Documented Evidence. Not merely a “vulnerability response procedure document,” but actual execution records for each CVE (scan results, CVSS scores, remediation history, VEX issuance, customer notification history) must be retained. For a detailed explanation of the strength difference, see §4.1.5 Standard Practices — Documented Evidence Notice.

1. Clause Overview

§4.3.2 is the core clause of ISO/IEC 18974 and is a new clause exclusive to 18974 that does not exist in ISO/IEC 5230. It requires establishing a procedure covering the entire process — vulnerability detection → risk assessment → remediation decision → customer consent (where applicable) → remediation → post-deployment newly disclosed vulnerability response → continuous monitoring — for each open source component in the SBOM, and maintaining implementation records. If §4.1.5 requires the existence of vulnerability handling methods, §4.3.2 requires that those methods have actually been applied to each component with records retained.

2024-11-27 취약점과 미래 - 다층적 소프트웨어 취약점과 대응 전략

Wed, 27 Nov 2024 00:00:00 +0000

source: https://openchainproject.org/news/2024/12/04/sbom-study-group-2024-11-27

1. 소개

이 블로그 포스트는 OpenChain Project의 SBOM Study Group 웨비나에서 발표된 “취약점과 미래 - 다층적 소프트웨어 취약점과 대응 전략"에 대한 내용을 다룹니다. 이 웨비나는 소프트웨어 공급망 보안과 취약점 관리의 중요성을 강조하며, 현재의 도전과제와 미래의 전략을 탐구합니다.

2. 발표자 소개

발표자인 Okada San은 OWASP Japan의 전문가로, 일본 기업에서 애플리케이션 보안 강화와 소프트웨어 생산성 팀을 지원하는 보안 연구원입니다. OWASP 재단의 평생 회원으로, 20년 이상 다양한 문서 번역 작업에 참여해 왔습니다.

Vulnerability on OpenChain KWG

OSV-SCALIBR

1. Features

2. Installation

Dependency-Track

Features

Installation

Building an Automated Open Source Management Environment: cdxgen + Dependency-Track

Why cdxgen + Dependency-Track

TRUSCA

§4.3.2 Security Assurance

1. Clause Overview

2024-11-27 취약점과 미래 - 다층적 소프트웨어 취약점과 대응 전략

목차

1. 소개

2. 발표자 소개