Finding a needle in a haystack: Automatic mining of silent vulnerability fixes

• Main Authors: ZHOU, Jiayuan, PACHECO, Michael, WAN, Zhiyuan, XIA, Xin, LO, David, WANG, Yuan, HASSAN, Ahmed E.
• Format: text
• Language: English
• Published: Institutional Knowledge at Singapore Management University 2021
• Subjects: Databases and Information Systems
• Online Access: https://ink.library.smu.edu.sg/sis_research/6896; https://ink.library.smu.edu.sg/context/sis_research/article/7899/viewcontent/Finding_A_Needle_in_a_Haystack.pdf
• Institution: Singapore Management University

Following the coordinated vulnerability disclosure model, a vulnerability in open source software (OSS) is suggested to be fixed “silently”, without disclosing the fix until the vulnerability is disclosed. Yet, it is crucial for OSS users to be aware of vulnerability fixes as early as possible, as o...