Open source software vulnerability control method and device

Abstract

The present invention belongs to the field of information security technology. The present invention provides an open source software vulnerability control method and device. The open source software vulnerability control method includes: obtaining characteristic values ​​corresponding to all code files in the system; traversing the characteristic values ​​in the open source software vulnerability database to generate traversal results; and controlling the open source software vulnerabilities in the system according to the traversal results. The present invention overcomes the drawbacks of the traditional processing methods for open source software vulnerabilities in the prior art. By using the open source software fingerprint code comparison method, the three fingerprints of the vulnerability software fingerprint, the enterprise use of the open source software fingerprint, and the fingerprint in the open source software vulnerability database library are compared to clarify the impact range of the current vulnerability. According to the vulnerability solution provided by the open source software vulnerability database, the open source software with vulnerabilities is automatically and effectively prevented from spreading, and the automatic production environment vulnerability repair is realized at the same time, so as to achieve the purpose of timely discovery, timely isolation, and automatic upgrade.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and specifically to a method and device for open source software vulnerability management and control. Background Art

[0002] With the explosive growth of open source software use in the financial industry and Internet companies, major companies usually focus on its availability and functional implementation when introducing open source software, but ignore its vulnerability control. The rapid development of the Internet has also brought about a huge explosion of open source software, but once a vulnerability breaks out, companies have no effective control measures to identify which vulnerabilities exist in the open source software used by the company, what are the impacts of these vulnerabilities, how to quickly grasp the vulnerability information and block the spread of vulnerabilities, and how to remedy the open source software with vulnerabilities that has been put into production. This is the most important problem that most Internet companies face in using open source software, and it is also a problem that needs to be solved urgently.

[0003] In the prior art, the way to control open source software vulnerabilities is to obtain the vulnerability risks of open source software through CNNVD (China National Information Security Vulnerability Database), and at the same time, it will publish information such as whether there is a fix for the vulnerability, emergency solutions, etc. Enterprises need to subscribe to this information. Once an open source software vulnerability is exposed (for example: the fastjson vulnerability in 2019), the enterprise will organize and sort out the applications currently deployed to production that use the open source software with vulnerabilities, and then organize emergency production patches to repair the impact of the vulnerability according to the vulnerability repair solution released by CNNVD.

[0004] The above approach has the following three shortcomings that seriously affect the efficiency of vulnerability repair: first, there is a certain delay in receiving the information released by CNNVD; second, it takes a lot of time to sort out which applications in the production environment use this open source software; and there is a time delay in patching production after the vulnerability is fixed. These three time delays create a long time window for the vulnerability to be exploited, which may cause huge security risks and property losses in serious cases. Summary of the invention

[0005] The present invention belongs to the field of information security technology. The present invention overcomes the lack of open source software vulnerability control by Internet companies in the financial and communications fields, as well as the low efficiency and long implementation period of traditional means, and provides an efficient, secure, intelligent and autonomous vulnerability control and governance solution and device.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0007] Get the characteristic values ​​corresponding to all code files in the system;

[0008] Traversing the characteristic values ​​in the open source software vulnerability database to generate traversal results;

[0009] The open source software vulnerabilities in the system are controlled based on the traversal results.

[0010] In one embodiment, obtaining the characteristic values ​​corresponding to all code files in the system includes:

[0011] Obtain the code file according to the current code base, the branch of the current code base, the original baseline of the current code base, and the current baseline of the current code base;

[0012] Calculate the MD5 value corresponding to the code file.

[0013] In one embodiment, the controlling the open source software vulnerabilities in the system according to the traversal results includes:

[0014] If the traversal result is an open source software vulnerability corresponding to the MD5 value that exists in the open source software vulnerability database, the open source software vulnerability is upgraded.

[0015] In one embodiment, upgrading the open source software vulnerability includes:

[0016] Determine the application service node and deployment node directory corresponding to the open source software vulnerability;

[0017] The open source software vulnerabilities of the application service nodes and the open source software vulnerabilities of the deployment node directory are upgraded respectively.

[0018] In a second aspect, the present invention provides an open source software vulnerability management and control device, the device comprising:

[0019] MD5 value acquisition unit, used to obtain the characteristic values ​​corresponding to all code files in the system;

[0020] A traversal result generating unit, used for traversing the characteristic value in the open source software vulnerability database to generate a traversal result;

[0021] The vulnerability control unit is used to control the open source software vulnerabilities in the system according to the traversal results.

[0022] In one embodiment, the MD5 value acquisition unit includes:

[0023] A code file acquisition module, used to acquire the code file according to the current code library, the branch of the current code library, the original baseline of the current code library, and the current baseline of the current code library;

[0024] The MD5 value calculation module is used to calculate the MD5 value corresponding to the code file.

[0025] In one embodiment, the vulnerability control unit is specifically used to upgrade the open source software vulnerabilities.

[0026] In one embodiment, the vulnerability control unit includes:

[0027] A node determination module, used to determine the application service node and deployment node directory corresponding to the open source software vulnerability;

[0028] The vulnerability upgrade module is used to upgrade the open source software vulnerabilities of the application service nodes and the open source software vulnerabilities of the deployment node directory respectively.

[0029] In a third aspect, the present invention provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of an open source software vulnerability control method when executing the program.

[0030] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of a method for managing and controlling open source software vulnerabilities.

[0031] From the above description, it can be seen that the embodiment of the present invention provides an open source software vulnerability control method and device, which first obtains the characteristic values ​​corresponding to all code files in the system; then, traverses the characteristic values ​​in the open source software vulnerability database to generate traversal results; finally, the open source software vulnerabilities in the system are controlled according to the traversal results. The present invention overcomes the shortcomings of the traditional methods for handling open source software vulnerabilities in the industry. By using the open source software fingerprint code comparison method, the three fingerprints of the vulnerability software fingerprint, the enterprise's use of the open source software fingerprint, and the fingerprint in the open source software vulnerability database are compared to clarify the impact scope of the current vulnerability. According to the vulnerability solution provided by the open source software vulnerability database, the open source software with vulnerabilities is automatically and effectively prevented from spreading, and automatic production environment vulnerability repair is realized at the same time, so as to achieve the purpose of timely discovery, timely isolation, and automatic upgrade. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0033] Figure 1 Schematic diagram of the process of the open source software vulnerability control method in an embodiment of the present invention;

[0034] Figure 2 1 is a flow chart of step 100 in an embodiment of the present invention;

[0035] Figure 3 300 is a flowchart of an embodiment of the present invention;

[0036] Figure 4 301 is a flowchart of step 301 in an embodiment of the present invention;

[0037] Figure 5 It is a flowchart of an open source software vulnerability control method in a specific application example of the present invention;

[0038] Figure 6 It is a structural diagram of an open source software vulnerability control device in an embodiment of the present invention;

[0039] Figure 7 Schematic diagram of the structure of the MD5 value acquisition unit 10 in an embodiment of the present invention;

[0040] Figure 8 Schematic diagram of the structure of the vulnerability control unit 30 in an embodiment of the present invention;

[0041] Fig. 9 It is a schematic diagram of the structure of an electronic device in an embodiment of the present invention. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0043] The embodiment of the present invention provides a specific implementation method of an open source software vulnerability management method, see Figure 1 , which specifically includes the following contents:

[0044] Step 100: Obtain the characteristic values ​​corresponding to all code files in the system.

[0045] Open-source software refers to software whose source code can be used by the public. The use, modification and distribution of this software are not restricted by licenses. Open-source software is developed by programmers scattered around the world, as well as by universities, government contractors, associations and commercial companies. The development of source code is a future-oriented innovation model characterized by open innovation, joint innovation and people-oriented brought about by the network revolution triggered by the development of information technology. Due to its friendly protocols and open collaborative development model, the number of open-source software has increased exponentially, and its use and dependence on it are more prominent in various industries, especially the Internet technology industry.

[0046] It can be understood that the code file in step 100 and its corresponding characteristic value have a one-to-one correspondence. A mapping between multiple code files in the system and their characteristic values ​​(note that there are also multiple) can be established first. Based on this mapping, each code file in the system can be accurately and quickly found.

[0047] Step 200: traversing the feature value in the open source software vulnerability database to generate a traversal result;

[0048] It is understandable that a vulnerability is a defect in the specific implementation of the hardware, software, or protocol of a computer information system or network, or in the system security policy, which can enable an attacker to access or damage the system without authorization. Therefore, once a vulnerability is discovered, corresponding protective measures should be taken, or patches should be applied, or replacement and upgrades should be made.

[0049] In step 200, the open source software vulnerability database can be the National Security Vulnerability Database (CNNVD), which sends various vulnerability information affecting system security on the Internet and corresponding solutions in real time. Specifically, the software fingerprint with vulnerabilities in the vulnerability database is compared with the vulnerability fingerprint of the enterprise production deployment to clarify the scope of vulnerability impact.

[0050] Step 300: Control open source software vulnerabilities in the system according to the traversal results;

[0051] Specifically, when the traversal result is that a corresponding feature value exists in the open source software vulnerability database, it means that a corresponding vulnerability exists in the system and needs to be upgraded. Otherwise, it is considered that the system is relatively safe at this time and no processing is required.

[0052] From the above description, it can be seen that the embodiment of the present invention provides an open source software vulnerability control method, which first obtains the characteristic values ​​corresponding to all code files in the system; then, traverses the characteristic values ​​in the open source software vulnerability database to generate traversal results; finally, the open source software vulnerabilities in the system are controlled according to the traversal results. The present invention overcomes the drawbacks of the industry's traditional methods for handling open source software vulnerabilities. By using the open source software fingerprint code comparison method, the three fingerprints of the vulnerability software fingerprint, the enterprise's use of the open source software fingerprint, and the fingerprint in the open source software vulnerability database are compared to clarify the scope of the current vulnerability. According to the vulnerability solution provided by the open source software vulnerability database, the open source software with vulnerabilities is automatically and effectively prevented from spreading, and automatic production environment vulnerability repair is realized at the same time, so as to achieve the purpose of timely discovery, timely isolation, and automatic upgrade.

[0053] In one embodiment, see Figure 2 , step 100 further comprises:

[0054] Step 101: Obtain the code file according to the current code library, the branch of the current code library, the original baseline of the current code library, and the current baseline of the current code library;

[0055] Specifically, by obtaining the current code base, the code branch used for the current build, the original baseline of the code branch of the current build, and all the code files involved in the current baseline of the code branch of the current build.

[0056] Step 102: Calculate the MD5 value corresponding to the code file;

[0057] It is understandable that the MD5 value corresponds to the characteristic value in step 100. MD5 (Message Digest Algorithm MD5) is one of the hash algorithms widely used by computers to ensure the integrity and consistency of information transmission and provide information integrity protection. The basic principle of MD5 is to compress data information into a 128-bit binary number and generate a message digest. MD5 can generate an equally unique "software fingerprint" for any file. If anyone makes any changes to the file, its MD5 value, that is, the corresponding "software fingerprint", will change.

[0058] In one embodiment, see Figure 3 , step 300 further comprises:

[0059] Step 301: If the traversal result is that the open source software vulnerability corresponding to the MD5 value exists in the open source software vulnerability database; then the open source software vulnerability is upgraded.

[0060] Specifically, after the information about the existing vulnerabilities is provided to the user for decision-making, the user can provide the vulnerability information and the recommended upgrade version to make a decision. After the user decides to upgrade the version, the product is rebuilt according to the recommended version selected by the user. On the other hand, when the build is performed again, the fingerprint code calculated by the build will be sent back to the vulnerability analysis tool for analysis. If the vulnerability analysis tool feedbacks that there is no vulnerability information in the build, the build is successful.

[0061] In one embodiment, see Figure 4 , step 301 further comprises:

[0062] Step 3011: Determine the application service node and deployment node directory corresponding to the open source software vulnerability;

[0063] Step 3012: Upgrade the open source software vulnerabilities of the application service node and the open source software vulnerabilities of the deployment node directory respectively.

[0064] In step 3011 and step 3012, according to the deployment definition file in the current product (deployment definition file: defines the application service node that the current product should be deployed, the corresponding application deployment node directory and other information), the product is first deployed on the server in the specified reinstallation verification environment for verification. The reinstallation verification environment will restart and execute the automated script verification according to the deployment strategy. If the restart is successful and the automated script verification passes, it means that the automatic repair of this vulnerability can be deployed in production.

[0065] From the above description, it can be seen that an embodiment of the present invention provides an open source software vulnerability management method, which does not require human intervention and is connected to an open source software vulnerability database (for example: CNNVD information security vulnerability library). The scope of vulnerability impact is clarified by comparing the software fingerprints with vulnerabilities in the vulnerability library with the vulnerability fingerprints deployed by the enterprise production. At the same time, the propagation of products with vulnerabilities is blocked at the source of construction to avoid the spread of vulnerabilities. For the vulnerable software that has been deployed and produced, an automatic upgrade solution is synchronized to repair the vulnerabilities and ensure production safety.

[0066] To further illustrate the present solution, the present invention also takes CNNVD as an example to provide a specific application example of the open source software vulnerability control method, see Figure 5 .

[0067] S1: Interface call with CNNVD.

[0068] Through the security vulnerability information interface provided by CNNVD, the latest vulnerability information can be synchronized back to the local database of the device in real time;

[0069] S2: Perform fingerprint matching on open source software with vulnerability information.

[0070] S3: Compare vulnerability information.

[0071] Specifically, when new vulnerability information is received, the vulnerability information will be matched with the open source software fingerprint code at the pre-product management information center; at the same time, the build tool will be notified of the vulnerability information; when building, the build tool will compare the vulnerability information in the device library. If vulnerability information exists, the current build will be terminated to prevent the vulnerable information from being built into a formally delivered product, thereby automatically preventing the spread of vulnerable software.

[0072] Furthermore, when the build tool is building a version product, it obtains the current code base, the code branch used for the current build, the original baseline of the code branch of the current build, and the current baseline of the code branch of the current build. After obtaining the build version base, branch, start, and end code baselines, the build tool will download all source code, jar files, and other information between the start and end of the current branch to the disk of the compiler to which the build tool belongs. Then, the build tool will start an independent thread to traverse the files in the specified disk directory on the current compiler. For Java code, it will be compiled into a bytecode file, and its MD5 value will also be calculated at the same time, with a focus on calculating the MD5 value of the .jar file. After calculating the MD5 values ​​of all files in the current build, this batch of MD5 values ​​will be sent back to the vulnerability analysis tool for comparison and analysis in the vulnerability library.

[0073] If the build tool compares and analyzes the MD5 passed by the current build and finds that the MD5 exists in the vulnerability information library, the build tool will be notified. After receiving the notification from the vulnerability analysis tool, the build tool will terminate the current build task and notify the user that there is a vulnerability risk file in the current build file. To prevent the vulnerability from spreading further, the user is asked to decide whether to automatically upgrade the vulnerability. The termination of the build task also blocks the path for the vulnerability to spread further from the root.

[0074] S4: After successfully matching the vulnerability information fingerprint with the product management center, all application information related to the vulnerability will be screened out;

[0075] S5: Check the application test environment that uses the vulnerable open source software. If the vulnerable open source software is used, use Maven to obtain the vulnerability upgrade and repair version according to the solution provided by CNNVD;

[0076] Specifically, after the build tool provides the user with information about the vulnerabilities in the current build for decision-making, the user can make a decision based on the vulnerability information and the recommended upgrade version provided by the build tool. After the user decides to upgrade the version, the build tool will actively rebuild the artifact according to the recommended version selected by the user. When the build tool builds again, it will send the fingerprint code calculated by this build back to the vulnerability analysis tool for analysis. If the vulnerability analysis tool reports that there is no vulnerability information in the current build, the build is successful. The build tool deploys the artifact on the server in the specified reinstallation verification environment for verification based on the deployment definition file in the current artifact (deployment definition file: defines the application service node where the current artifact should be deployed, the corresponding application deployment node directory, and other information). The reinstallation verification environment will restart and execute the automated script verification according to the deployment strategy. If the restart is successful and the automated script verification passes, it means that the automatic repair of this vulnerability can be deployed in production. The version artifact that passes the reinstallation verification will distinguish the production environment by parameters, execute the deployment definition file through the build tool, and complete the automatic deployment and verification on production, completing the automatic upgrade function.

[0077] S6: Notify the build tool to rebuild the version package and deploy the new version in the verification environment;

[0078] S7: Reinstall the verification component for reinstallation verification.

[0079] If the reinstallation verification passes, the version will be automatically released to production; poll other applications involved in the current vulnerability and fix and upgrade them one by one; after the polling is completed, the impact scope of the vulnerability, affected functions, and repair results will be notified to the responsible person of each application by email.

[0080] From the above description, it can be seen that the embodiment of the present invention provides an open source software vulnerability management method, which overcomes the lack of open source software vulnerability management in Internet companies in the financial and communications fields, as well as the inefficiency of traditional means and the long implementation period, and provides an efficient, safe, intelligent and autonomous vulnerability management and governance method. This method supports non-invasive support for all enterprise applications, transforming traditional post-governance strategies into pre-control solutions, effectively helping enterprises avoid economic losses and security risks of vulnerability codes. Its beneficial effects are as follows:

[0081] 1. Simple operation: After the tool is deployed, the entire process is automated without the need for human intervention. Once a vulnerability is exposed, it will be automatically identified by the device.

[0082] 2. High efficiency: Compared with manual handling of vulnerability issues, this tool can automatically upgrade vulnerability files without human intervention, while avoiding reorganizing versions and patching.

[0083] 3. High timeliness: Connect with CNNVD to trigger the device to repair the vulnerability as soon as the vulnerability is exposed.

[0084] 4. High degree of intelligence: After a vulnerability is exposed, it can automatically isolate the spread of vulnerable open source software in the first time and stop the spread of the vulnerability from the source in the first time.

[0085] 5. High security: During the process of automatically repairing vulnerabilities, the device will trigger the reinstallation verification component to verify the upgraded application service in a simulated test environment. After the verification is passed, it will be automatically deployed to production to avoid the risk of rolling back the production environment due to failure to work properly after the upgrade.

[0086] Based on the same inventive concept, the embodiments of the present application also provide an open source software vulnerability control device, which can be used to implement the method described in the above embodiments, such as the following embodiments. Since the principle of solving the problem by the open source software vulnerability control device is similar to that of the open source software vulnerability control method, the implementation of the open source software vulnerability control device can refer to the implementation of the open source software vulnerability control method, and the repeated parts will not be repeated. As used below, the term "unit" or "module" can be a combination of software and / or hardware that implements predetermined functions. Although the system described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceived.

[0087] The embodiment of the present invention provides a specific implementation of an open source software vulnerability control device capable of implementing an open source software vulnerability control method, see Figure 6 , the open source software vulnerability control device specifically includes the following contents:

[0088] MD5 value acquisition unit 10, used to obtain the characteristic values ​​corresponding to all code files in the system;

[0089] A traversal result generating unit 20, configured to traverse the feature value in the open source software vulnerability database to generate a traversal result;

[0090] The vulnerability control unit 30 is used to control the open source software vulnerabilities in the system according to the traversal results.

[0091] In one embodiment, see Figure 7 , the MD5 value acquisition unit 10 includes:

[0092] A code file acquisition module 101 is used to acquire the code file according to a current code book library, a branch of the current code book library, an original baseline of the current code book library, and a current baseline of the current code book library;

[0093] The MD5 value calculation module 102 is used to calculate the MD5 value corresponding to the code file.

[0094] In one embodiment, the vulnerability control unit is specifically used to upgrade the open source software vulnerabilities.

[0095] In one embodiment, see Figure 8 , the vulnerability control unit 30 includes:

[0096] The node determination module 301 is used to determine the application service node and deployment node directory corresponding to the open source software vulnerability;

[0097] The vulnerability upgrade module 302 is used to upgrade the open source software vulnerabilities of the application service nodes and the open source software vulnerabilities of the deployment node directory respectively.

[0098] From the above description, it can be seen that an embodiment of the present invention provides an open source software vulnerability control device, which first obtains the characteristic values ​​corresponding to all code files in the system; then, traverses the characteristic values ​​in the open source software vulnerability database to generate traversal results; and finally controls the open source software vulnerabilities in the system according to the traversal results. The present invention overcomes the drawbacks of the industry's traditional methods for handling open source software vulnerabilities. By using the open source software fingerprint code comparison method, the three fingerprints of the vulnerability software fingerprint, the enterprise's use of the open source software fingerprint, and the fingerprint in the open source software vulnerability database are compared to clarify the impact scope of the current vulnerability. According to the vulnerability solution provided by the open source software vulnerability database, the open source software with vulnerabilities is automatically and effectively prevented from spreading, and automatic production environment vulnerability repair is realized at the same time, so as to achieve the purpose of timely discovery, timely isolation, and automatic upgrade.

[0099] The embodiments of the present application also provide a specific implementation of an electronic device that can implement all steps in the open source software vulnerability control method in the above embodiments, see Fig. 9 , electronic equipment specifically includes the following:

[0100] Processor (processor) 1201, memory (memory) 1202, communication interface (CommunicationsInterface) 1203 and bus 1204;

[0101] The processor 1201, the memory 1202, and the communication interface 1203 communicate with each other through the bus 1204; the communication interface 1203 is used to realize information transmission between the server device and the client device and other related devices;

[0102] The processor 1201 is used to call the computer program in the memory 1202. When the processor executes the computer program, all steps in the open source software vulnerability control method in the above embodiment are implemented. For example, when the processor executes the computer program, the following steps are implemented:

[0103] Step 100: Obtain the characteristic values ​​corresponding to all code files in the system;

[0104] Step 200: traversing the feature value in the open source software vulnerability database to generate a traversal result;

[0105] Step 300: Control open source software vulnerabilities in the system according to the traversal results.

[0106] The embodiments of the present application also provide a computer-readable storage medium capable of implementing all the steps in the open source software vulnerability control method in the above embodiments. The computer-readable storage medium stores a computer program. When the computer program is executed by a processor, all the steps in the open source software vulnerability control method in the above embodiments are implemented. For example, when the processor executes the computer program, the following steps are implemented:

[0107] Step 100: Obtain the characteristic values ​​corresponding to all code files in the system;

[0108] Step 200: traversing the feature value in the open source software vulnerability database to generate a traversal result;

[0109] Step 300: Control open source software vulnerabilities in the system according to the traversal results.

[0110] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the hardware + program embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0111] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0112] Although the present application provides method operation steps such as embodiments or flow charts, more or fewer operation steps may be included based on conventional or non-creative labor. The order of steps listed in the embodiments is only one way of executing the order of many steps and does not represent the only execution order. When the actual device or client product is executed, it can be executed in the order of the method shown in the embodiments or the drawings or in parallel (for example, in a parallel processor or multi-threaded processing environment).

[0113] For the convenience of description, the above devices are described in various modules according to their functions. Of course, when implementing the embodiments of this specification, the functions of each module can be implemented in the same or more software and / or hardware, or the module implementing the same function can be implemented by a combination of multiple sub-modules or sub-units. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0114] Those skilled in the art also know that, in addition to implementing the controller in a purely computer-readable program code, the controller can be made to implement the same function in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, such a controller can be considered as a hardware component, and the devices for implementing various functions included therein can also be considered as structures within the hardware component. Or even, the devices for implementing various functions can be considered as both software modules for implementing the method and structures within the hardware component.

[0115] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0116] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0117] The present specification embodiments may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present specification embodiments may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0118] Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. In the description of this specification, the description of the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the embodiment of this specification. In this specification, the schematic representation of the above terms does not necessarily target the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, in the absence of contradiction, a person skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0119] The above is only an example of the embodiment of the present specification and is not intended to limit the embodiment of the present specification. For those skilled in the art, the embodiment of the present specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the embodiment of the present specification shall be included in the scope of the claims of the embodiment of the present specification.

Claims

1. A method for managing and controlling open source software vulnerabilities, characterized in that: include: Get the characteristic values ​​corresponding to all code files in the system; Traversing the characteristic values ​​in the open source software vulnerability database to generate traversal results; Control open source software vulnerabilities in the system based on the traversal results; Check the application test environment of the open source software that uses the vulnerability corresponding to the new vulnerability information. If the open source software is used, obtain the vulnerability upgrade and fix version and upgrade it; The method of obtaining the characteristic values ​​corresponding to all code files in the system includes: Obtain the code file according to the current code base, the branch of the current code base, the original baseline of the current code base, and the current baseline of the current code base; Calculate the MD5 value corresponding to the code file, specifically: When building a version product, the build tool obtains the current code base, the branch of the current code base, the original baseline of the current code base, and the current baseline of the current code base; after obtaining the current code base, the branch of the current code base, the original baseline of the current code base, and the current baseline of the current code base, the build tool will download all source code and jar file information between the original baseline of the current code base and the current baseline of the current code base on the current branch to the disk of the compiler to which the build tool belongs; then, the build tool starts an independent thread to traverse the files in the specified disk directory on the current compiler, compiles the Java code into a bytecode file, and calculates its MD5 value at the same time. After calculating the MD5 values ​​of all files in the current build, this batch of MD5 values ​​is sent back to the vulnerability analysis tool for comparison and analysis in the open source software vulnerability database by the vulnerability analysis tool; The controlling the open source software vulnerabilities in the system according to the traversal results includes: If the vulnerability analysis tool compares and analyzes the MD5 value passed by the current build and finds that the MD5 value exists in the open source software vulnerability database, the build tool will be notified. After receiving the notification from the vulnerability analysis tool, the build tool will terminate the current build task and notify the user that there is a vulnerability risk file in the current build file. The process of checking the application test environment of the open source software using the vulnerability corresponding to the new vulnerability information, and if the open source software is used, obtaining the vulnerability upgrade repair version and upgrading it, includes: After the build tool provides the user with information about vulnerabilities in the current build for decision-making, the user makes a decision based on the vulnerability information and recommended upgrade version provided by the build tool; after the user decides to upgrade the version, the build tool actively rebuilds the artifact according to the recommended version selected by the user; when the build tool builds again, it sends the fingerprint code calculated by this build back to the vulnerability analysis tool for analysis. If the vulnerability analysis tool feedbacks that there is no vulnerability information in the current build, the build is successful; the build tool deploys the artifact on the server in the specified reinstallation verification environment for verification based on the deployment definition file in the current artifact; restarts and executes automated script verification in the reinstallation verification environment according to the deployment strategy. If the restart is successful and the automated script verification passes, it indicates that the automatic vulnerability repair can be deployed in production; wherein, the deployment definition file includes: defining the application service node where the current artifact should be deployed and the corresponding application deployment node directory.

2. The open source software vulnerability control method according to claim 1, characterized in that: Upgrading the open source software vulnerabilities includes: Determine the application service node and deployment node directory corresponding to the open source software vulnerability; The open source software vulnerabilities of the application service nodes and the open source software vulnerabilities of the deployment node directory are upgraded respectively.

3. An open source software vulnerability control device, characterized in that: include: MD5 value acquisition unit, used to obtain the characteristic values ​​corresponding to all code files in the system; A traversal result generating unit, used for traversing the characteristic value in the open source software vulnerability database to generate a traversal result; A vulnerability control unit, used to control the open source software vulnerabilities in the system according to the traversal results; The vulnerability control unit is further used to check the application test environment of the open source software using the vulnerability corresponding to the new vulnerability information, and if the open source software is used, obtain the vulnerability upgrade and repair version and upgrade it; The MD5 value acquisition unit includes: A code file acquisition module, used to acquire the code file according to the current code library, the branch of the current code library, the original baseline of the current code library, and the current baseline of the current code library; An MD5 value calculation module, used to calculate the MD5 value corresponding to the code file; The step of calculating the MD5 value corresponding to the code file comprises: When building a version product, the build tool obtains the current code base, the branch of the current code base, the original baseline of the current code base, and the current baseline of the current code base; after obtaining the current code base, the branch of the current code base, the original baseline of the current code base, and the current baseline of the current code base, the build tool will download all source code and jar file information between the original baseline of the current code base and the current baseline of the current code base on the current branch to the disk of the compiler to which the build tool belongs; then, the build tool starts an independent thread to traverse the files in the specified disk directory on the current compiler, compiles the Java code into a bytecode file, and calculates its MD5 value at the same time. After calculating the MD5 values ​​of all files in the current build, this batch of MD5 values ​​is sent back to the vulnerability analysis tool for comparison and analysis in the open source software vulnerability database by the vulnerability analysis tool; The controlling the open source software vulnerabilities in the system according to the traversal results includes: If the vulnerability analysis tool compares and analyzes the MD5 value passed by the current build and finds that the MD5 value exists in the open source software vulnerability database, the build tool will be notified. After receiving the notification from the vulnerability analysis tool, the build tool will terminate the current build task and notify the user that there is a vulnerability risk file in the current build file. The application test environment of the open source software using the vulnerability corresponding to the new vulnerability information is checked, and if the open source software is used, the vulnerability upgrade and repair version is obtained and upgraded, including: when the build tool provides the information of the vulnerability in the current build to the user for decision-making, the user makes a decision based on the vulnerability information and the recommended upgrade version provided by the build tool; after the user decides to upgrade the version, the build tool actively rebuilds the product according to the recommended version selected by the user; when the build tool builds again, the fingerprint code calculated by the current build will be sent back to the vulnerability analysis tool for analysis, if the vulnerability analysis tool feedbacks that there is no vulnerability information in the current build, the build is successful; the build tool deploys the product on the server in the specified reinstallation verification environment for verification according to the deployment definition file in the current product; restarts and executes automated script verification in the reinstallation verification environment according to the deployment strategy, if the restart is successful and the automated script verification passes; it indicates that the automatic repair of this vulnerability can be deployed for production; wherein, the deployment definition file includes: defining the application service node where the current product should be deployed and the corresponding application deployment node directory.

4. The open source software vulnerability control device according to claim 3, characterized in that: The vulnerability control unit includes: A node determination module, used to determine the application service node and deployment node directory corresponding to the open source software vulnerability; The vulnerability upgrade module is used to upgrade the open source software vulnerabilities of the application service nodes and the open source software vulnerabilities of the deployment node directory respectively.

5. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the open source software vulnerability management method described in any one of claims 1 to 2 are implemented.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the open source software vulnerability control method described in any one of claims 1 to 2 are implemented.

Images