Shaded Vulnerability Detection Data - Sonatype Lifecycle & Repository Firewall - Sonatype Community

Shaded Vulnerability Detection Data

post by rspooner on Jun 7, 2024

NOTE: This is an ongoing release. Stay tuned to this community post for updates and educational materials.

The initial release of the highest severity vulnerabilities with a CVSS of 10 will begin on Monday, September 9, 2024. A table outlining the updated drip schedule is available at this link.

Shaded Vulnerability Detection

As we shared in a press release, Sonatype’s new Shaded Vulnerability Detection capability has identified 4.5 million new open-source vulnerabilities, including 336,000 previously undetectable “Critical” open source vulnerabilities.

This industry-first data enhancement comes from a novel, Sonatype-created algorithm capable of detecting vulnerabilities in “shaded” open source files—a technique in which original code is repackaged, often making detection by traditional means impossible.

Data regarding these vulnerabilities will be introduced to the Sonatype Platform starting September 09, 2024.

What’s changing?

When we release the first “drip” of this data in September, you will likely notice some changes:

To start, most Sonatype Lifecycle and SBOM Manager customers will see new critical violations in their reports.
Depending on policy configuration, Sonatype Lifecycle and Sonatype Repository Firewall customers may also receive notifications, have builds blocked, or have components quarantined.

It’s important to note that this is a new capability within our vulnerability detection, providing you with better, more comprehensive data. It is NOT a change in how IQ Server scans your applications.

Who do these changes impact?

This change will primarily impact:

Products: Sonatype Lifecycle, Sonatype Repository Firewall, and SBOM Manager

Deployment Types: This change will impact customers of all deployment types (Self-hosted, Private Cloud, SaaS, and Sonatype Air-Gapped Environment (SAGE))

Ecosystems: Maven, PyPI, and RubyGems

In addition, packages in the following ecosystems also have a low chance of showing a new vulnerability:

Cargo
Composer
CRAN
npm
NuGet
RPM

How should I prepare for this change?

To prepare for the release of this new capability, we recommend following these three key steps to determine how the rollout of this data enhancement will impact your organization:

Understand the Incremental Release of Data
Review your Risk: Shaded Vulnerability Detection Dashboard
Create a Proactive Remediation Plan

Here is a little more about each step:

1. Understand the Incremental Release of Data (a.k.a., Data “drip”)

Due to the large scale of data uncovered by our Shaded Vulnerability Detection capability, we will release it in small increments (a.k.a., “drips”) starting on Monday, September 09, 2024.

The initial release will target the highest severity vulnerabilities, with a CVSS (Common Vulnerability Scoring System) of 10.

While this approach may take a bit longer, it allows you to better manage any policy violations that may arise, providing you time to review your risk, create remediation plans, and communicate with stakeholders about this new data.

2. Review your Risk: Shaded Vulnerability Detection Dashboard

The best way to prepare for this change is to use the Shaded Vulnerability Detection Dashboard—found within the Integrated Enterprise Reporting area of IQ Server—to estimate the impact on your organization. This help doc details everything you need to know about the dashboard.

This dashboard summarizes the quantity and severity of the new violations you’ll see when this data is released starting on September 09, 2024.

NOTE: To access the dashboard, it will require IQ Server Version 177.

If you can’t upgrade directly to 177, spin up a test instance and copy data from your production instance. If that’s not possible, don’t hesitate to contact your assigned CSE or CSA, if applicable.

3. Create a Proactive Remediation Plan

Once you have access to the Shaded Vulnerability Detection dashboard, we encourage you to review this 10-minute lesson from the Sonatype Learn team, which will:

Explain what this data means for your organization in simple terms.
Suggest some best practices for handling this data.
Give you advice on how to prepare.

The lesson breaks down the following steps we recommend in understanding what Shaded Vulnerability Detection means for you and how to prepare:

Gauge the data impact: Once you have access to the dashboard, note the total number of new vulnerabilities expected and the apps in which these vulnerabilities appear. Use these two data points to estimate the total impact of this change on your organization.
Planning for potential disruption: Alert stakeholders, like developers and project managers, of possible disruptions in their development and build/release processes. Remember, based on these new vulnerabilities, your policies can fail builds or quarantine components.
Address disruption and investigate vulnerabilities: Set aside time to deal with these disruptions adequately. At the very least, you must be prepared to investigate new vulnerabilities and waive restrictions to get developers unblocked.
Be strategic: Ensure stakeholders know about remediation tools like Automatic Pull Requests. Also, take a moment to refamiliarize yourself with Advanced Search and Waiver Best Practices.

Where can I ask additional questions?

Reply directly to this post. If you are not already registered with the Sonatype Community, you will be prompted to create an account. This will empower you to create and reply to other threads initiated by both the Sonatype team and your community peers.

Notifications can be easily configured to ensure you are aware of updates for a specific thread and/or important announcements within the Community.