Augmenting Software Bills of Materials with Software Vulnerability Description: A Preliminary Study on GitHub
Fuente:
arXiv
Salvato in:
| Autori principali: | , , , |
|---|---|
| Natura: | Preprint |
| Pubblicazione: |
2025
|
| Soggetti: | |
| Accesso online: | |
| Tags: |
Aggiungi Tag
Nessun Tag, puoi essere il primo ad aggiungerne!!
|
| _version_ | 1866909625365823488 |
|---|---|
| author | Fucci, Davide Di Penta, Massimiliano Romano, Simone Scanniello, Giuseppe |
| author_facet | Fucci, Davide Di Penta, Massimiliano Romano, Simone Scanniello, Giuseppe |
| contents | Software Bills of Material (SBOMs) are becoming a consolidated, often enforced by governmental regulations, way to describe software composition. However, based on recent studies, SBOMs suffer from limited support for their consumption and lack information beyond simple dependencies, especially regarding software vulnerabilities. This paper reports the results of a preliminary study in which we augmented SBOMs of 40 open-source projects with information about Common Vulnerabilities and Exposures (CVE) exposed by project dependencies. Our augmented SBOMs have been evaluated by submitting pull requests and by asking project owners to answer a survey. Although, in most cases, augmented SBOMs were not directly accepted because owners required a continuous SBOM update, the received feedback shows the usefulness of the suggested SBOM augmentation. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2503_13998 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | Augmenting Software Bills of Materials with Software Vulnerability Description: A Preliminary Study on GitHub Fucci, Davide Di Penta, Massimiliano Romano, Simone Scanniello, Giuseppe Software Engineering Software Bills of Material (SBOMs) are becoming a consolidated, often enforced by governmental regulations, way to describe software composition. However, based on recent studies, SBOMs suffer from limited support for their consumption and lack information beyond simple dependencies, especially regarding software vulnerabilities. This paper reports the results of a preliminary study in which we augmented SBOMs of 40 open-source projects with information about Common Vulnerabilities and Exposures (CVE) exposed by project dependencies. Our augmented SBOMs have been evaluated by submitting pull requests and by asking project owners to answer a survey. Although, in most cases, augmented SBOMs were not directly accepted because owners required a continuous SBOM update, the received feedback shows the usefulness of the suggested SBOM augmentation. |
| title | Augmenting Software Bills of Materials with Software Vulnerability Description: A Preliminary Study on GitHub |
| topic | Software Engineering |
| url | https://arxiv.org/abs/2503.13998 |