2278
alternatives, such as OWASP Dependency-Check [REF-1312]. Many languages or frameworks
have package managers with similar capabilities, such as npm audit for JavaScript, pip-audit for
Python, govulncheck for Go, and many others. Dynamic methods can detect loading of thirdparty
components.
Effectiveness = High
Software Composition Analysis (SCA) tools face a number of technical challenges that can lead
to false positives and false negatives. Dynamic methods have other technical challenges.
Potential Mitigations
Phase: Requirements
Phase: Policy
In some industries such as healthcare [REF-1320] [REF-1322] or technologies such as the cloud
[REF-1321], it might be unclear about who is responsible for applying patches for third-party
vulnerabilities: the vendor, the operator/customer, or a separate service. Clarifying roles and
responsibilities can be important to minimize confusion or unnecessary delay when third-party
vulnerabilities are disclosed.
Phase: Requirements
Require a Bill of Materials for all components and sub-components of the product. For software,
require a Software Bill of Materials (SBOM) [REF-1247] [REF-1311].
Phase: Architecture and Design
Phase: Implementation
Phase: Integration
Phase: Manufacturing
Maintain a Bill of Materials for all components and sub-components of the product. For software,
maintain a Software Bill of Materials (SBOM). According to [REF-1247], "An SBOM is a formal,
machine-readable inventory of software components and dependencies, information about those
components, and their hierarchical relationships."
Phase: Operation
Phase: Patching and Maintenance
Actively monitor when a third-party component vendor announces vulnerability patches; fix the
third-party component as soon as possible; and make it easy for operators/customers to obtain
and apply the patch.
Phase: Operation
Phase: Patching and Maintenance
Continuously monitor changes in each of the product's components, especially when the
changes indicate new vulnerabilities, end-of-life (EOL) plans, etc.
Demonstrative Examples
Example 1:
The "SweynTooth" vulnerabilities in Bluetooth Low Energy (BLE) software development kits (SDK)
were found to affect multiple Bluetooth System-on-Chip (SoC) manufacturers. These SoCs were
used by many products such as medical devices, Smart Home devices, wearables, and other IoT
devices. [REF-1314] [REF-1315]
Example 2:
log4j, a Java-based logging framework, is used in a large number of products, with estimates
in the range of 3 billion affected devices [REF-1317]. When the "log4shell" (CVE-2021-44228)
vulnerability was initially announced, it was actively exploited for remote code execution, requiring
CWE Version 4.14
CWE-1395: Dependency on Vulnerable Third-Party Component
CWE-1395: Dependency on Vulnerable Third-Party Component