From Discovery to Fix: What 10,000 Open Source Projects Reveal About CVE Remediation
summary
Analysis of 10,000 open‑source projects and 10 million findings shows long MTTR: 90% of CVEs already have fixes yet about 40% remain in containers for over 6 months, creating big exposure windows in Kubernetes. Most mitigation is propagation not patching: pulling the latest tag and using slim images with multi‑stage builds cuts CVE counts (latest tags have ~80% fewer CVEs and ~40% fewer in practice). Recommended tooling and patterns: Dependabot/ Renovate, Copa and Copacetic for in‑place image patching and automated backports.
AI-written summary · about
chapters (14)
- 0:00Vulnerability discovery limits
- 2:31CVEs with fixes available
- 5:23AI in finding vs fixing
- 8:11Maintainer burden of AI reports
- 13:28AI replacing discovery-to-fix?
- 17:42CNAs streamline CVE assignments
- 20:10Fix to deployment gap
- 23:23Container image bloat delays
- 25:51Latest tags cut exposure 40%
- 27:16Minimal images slash CVEs
- 29:00Automating with Dependabot
- 29:44Patching without rebuilding
- 30:26Key takeaways for remediation
- 32:35Q&A
related talks
35mWhy Isn't the Fix in My Container? Tracking CVE Propagation Across 10,000 Projects.
35mKeeping Up with the CVEs: How to Find a Needle in a Haystack?
56mOutpacing Attackers: How Data-Driven Insights Speed Up Vulnerability Remediation
21mDevSecOops: 15 years of DevOps and patching is still horrible
41mThe CVE Blind Spot: Defeating "Hidden EOLs" and Repo Jacking with Engineering Triage & Code Diet
27mThrough the Looking Glass: How Open Source Projects See Vulnerability Disclosure
14mThe State of Open Source Vulnerabilities Management in 2019
47mThe Open Source Paradox: Unpacking Risk, Equity, and Acceptance