Compatible Remediation on Vulnerabilities from Third-Party Libraries for Java Projects

TL;DR

This paper introduces CORAL, a method for fixing vulnerabilities in Java Maven projects that maximizes compatibility, achieving high success rates in vulnerability fixing and maintaining project compilability and test success.

Contribution

CORAL is a novel approach that improves vulnerability remediation in Maven projects by ensuring compatibility and reducing breakages compared to existing tools.

Findings

CORAL fixed 87.56% of vulnerabilities, outperforming other tools.

98.67% of projects remained successfully compilable after remediation.

78.45% of vulnerabilities could be fixed without breaking compilation.

Abstract

With the increasing disclosure of vulnerabilities in open-source software, software composition analysis (SCA) has been widely applied to reveal third-party libraries and the associated vulnerabilities in software projects. Beyond the revelation, SCA tools adopt various remediation strategies to fix vulnerabilities, the quality of which varies substantially. However, ineffective remediation could induce side effects, such as compilation failures, which impede acceptance by users. According to our studies, existing SCA tools could not correctly handle the concerns of users regarding the compatibility of remediated projects. To this end, we propose Compatible Remediation of Third-party libraries (CORAL) for Maven projects to fix vulnerabilities without breaking the projects. The evaluation proved that CORAL not only fixed 87.56% of vulnerabilities which outperformed other tools (best 75.32%) and achieved a 98.67% successful compilation rate and a 92.96% successful unit test rate. Furthermore, we found that 78.45% of vulnerabilities in popular Maven projects could be fixed without breaking the compilation, and the rest of the vulnerabilities (21.55%) could either be fixed by upgrades that break the compilations or even be impossible to fix by upgrading.