Vulnerable Open Source Dependencies: Counting Those That Matter
https://arxiv.org/abs/1808.09753
Method
"To understand the industrial impact of the proposed methodology, we considered the 200 most popular OSS Java libraries used by SAP in its own software."
Population
"Our analysis included 10905 distinct GAVs (group, artifact, version) when considering all the library versions."
What it does not show
Deployed scope is still a static proxy for reachability, not proof the vulnerable function is called at runtime — the paper targets over-counting from naive advisory matching, not under-counting from missed dynamic paths. One company’s Java usage; not shown to generalise to other ecosystems, and it does not report whether the fixable dependencies were in fact fixed.
Ivan Pashchenko, Henrik Plate, Serena Elisa Ponta, Antonino Sabetta, Fabio Massacci
Separates presence from exposure: about 20% of dependencies flagged as affected by a known vulnerability are never deployed — test or build scope only — and cannot be exploited in practice. Of the deployed ones, 81% are remediable by a simple version bump, the library’s own developers can fix 82% directly, and only 1% sit on an unmaintained library with no fix available.
Tier III: Single-organisation case study over the libraries one company actually uses, with real counts but no cross-organisation comparison group.