The Distributed Open-Source Vulnerability Ecosystem
Cryptography and SecuritySoftware Engineering
Summary
The authors explain that identifying software vulnerabilities is complicated because different scanners can give different results even for the same software. They show that these differences come from various steps in how vulnerability information is shared and changed, not just from the tools themselves. Their framework looks at how data is created, updated, and interpreted differently depending on context. They also point out key reasons for these inconsistencies, like different ways of naming software versions and changing information over time. Finally, they discuss what this means for understanding scanner results and improving evaluation methods.
Authors
Peter Mandl, Paul Mandl
Abstract
Identifying known software vulnerabilities is a central task in software supply chain security management. Although publicly available vulnerability information is based on shared standards, different vulnerability scanners often report divergent results for identical software inventories. These differences do not arise solely from individual data sources or scanner implementations. They can emerge at several stages of the open-source vulnerability ecosystem. This paper presents a conceptual framework that describes vulnerability management as a distributed process of information exchange and transformation. It traces vulnerability information from its creation and standardization through enrichment to context-dependent interpretation. The analysis identifies heterogeneous information sources, divergent identity and version models, temporal change, and context-dependent assessment as major causes of inconsistent scanner findings. It then discusses the implications for interpreting analysis results, designing reproducible evaluation methods, and handling dynamic vulnerability knowledge in practice.