Google launches new tool to identify open source vulnerabilities

▤ Summary

Google has released a new free tool that allows open-source developers to more easily access vulnerability information relevant to their projects. The Go-based tool — called OSV-Scanner — provides an automated capability to match a developer’s code and dependencies against lists of known vulnerabilities and deliver instant feedback if patches or updates are needed. This practice creates what are known as “transitive dependencies” in software, and means it may contain multiple layers of vulnerability that are hard to track manually. According to Google, the new tool will start with finding these transitive dependencies by analyzing manifests, software bills of materials (SBOMs) where available, and commit hashes. “The OSV-Scanner generates reliable, high-quality vulnerability information that closes the gap between a developer’s list of packages and the information in vulnerability databases,” Rex Pan, software engineer at Google Open Source security team, said in the blog post.

▦ Linked Companies

Sonatype

$10M to $25M