Why Isn't the Fix in My Container? Tracking CVE Propagation Across 10,000 Projects.
summary
Analysis of 10,000 open-source projects (daily scans for a year) tracks ~40,000 CVE paths and finds that 89% fixes exist but distribution lags: 40% take >180 days to reach downstream images, often due to release cycles, pinned indirect deps, or unrebuilt base images. Containers cut vulnerabilities by using minimal images (Python slim cuts ~95%), removing unused packages (56% removable by removing bloat), pulling updated images, and applying automated backporting or in-place patching tools like Copa.
AI-written summary · about
chapters (13)
- 0:00Introduction and motivation
- 1:53Rising CVE numbers and risks
- 3:16CVE lifecycle and delays
- 6:10AI's role in vulnerability discovery
- 7:15Maintainer struggles with AI reports
- 10:47Smaller projects and maintainer fatigue
- 13:59Can AI replace vulnerability discovery?
- 15:24Reporting vulnerabilities correctly
- 18:37Summary of CVE challenges
- 19:41Leaks in CVE remediation process
- 22:12Practical mitigation strategies
- 27:58Top three takeaways
- 28:38Q&A session
related talks
39mFrom Discovery to Fix: What 10,000 Open Source Projects Reveal About CVE Remediation
52mThe Life of an Image: Evolution of Vulnerabilities in Popular Containers
25mMy Container Image has 500 Vulnerabilities, Now What?
35mKeeping Up with the CVEs: How to Find a Needle in a Haystack?
40mPanel Discussion: Open Source Supply Chain Security - Are Containers..
38mSo. Many. Vulnerabilities. Why are containers such a mess...
29mDay in the Life of a Base Image: The Evolution of Vulnerabilities in the Most Popular C...
24mOvercoming CVE Shock - Adding Perspective in Vulnerability Scanning