As cited
Copy frozen at (site build).
vulnerabilities
Multi-patch vulnerability fixes can leave open source exposed
Researchers at the University of Texas at Dallas examined 1,646 open source CVEs with multiple patches and found that some vulnerabilities arrive as a series of commits where the initial patch leaves the flaw in place. This multi-patch approach to vulnerability fixes differs from the standard single-patch model that security teams typically expect.
Why it matters: Open source maintainers and security teams relying on the standard patch-and-close workflow risk missing incompletely patched vulnerabilities if they don't verify that all commits in a patch series address the full issue.
- Source published
- First seen by Cybersecurity Tracker