The Beauty and the Beast: Vulnerabilities in Red Hat’s Packages Stephan Neuhaus Thomas Zimmermann Dipartimento di Informatica e Telecomunicazioni Microsoft Research Universita` degli Studi di Trento One Microsoft Way I-38100 Trento, Italy Redmond, Washington, USA
[email protected] [email protected] Abstract In this paper, we show that vulnerabilities correlate In an empirical study of 3241 Red Hat packages, we with dependencies between software packages. For ex- show that software vulnerabilities correlate with depen- ample, when depending on Python the risk of an applica- dencies between packages. With formal concept analy- tion being vulnerable decreases, while the risk increases sis and statistical hypothesis testing, we identify depen- when depending on PHP or Perl. In addition, we demon- dencies that decrease the risk of vulnerabilities (“beau- strate how to use dependencies to build prediction mod- ties”) or increase the risk (“beasts”). Using support vec- els for vulnerabilities. More specifically, our contribu- tor machines on dependency data, our prediction models tions are as follows: successfully and consistently catch about two thirds of vulnerable packages (median recall of 0.65). When our 1. Empirical evidence that vulnerabilities correlate models predict a package as vulnerable, it is correct more with dependencies. Our study of 3241 Red Hat than eight times out of ten (median precision of 0.83). packages is the largest study of vulnerabilities ever Our findings help developers to choose new dependen- conducted in terms of number of investigated appli- cies wisely and make them aware of risky dependencies. cations. 2. Identification of dependencies with positive or neg- 1 Introduction ative impact on vulnerabilities.