Vulnerability Response of Last Resort

Vulnerability Response of Last Resort

Speakers: Diogo Yogu, Engineering Manager, Canonical

Conference: VulnCon

YouTube: https://www.youtube.com/watch?v=AqT5_tUBBdM

Overview

Diogo Yogu's talk, "Vulnerability Response of Last Resort: Dealing with Undermaintained Packages in the Open Source Ecosystem," addresses a critical and growing challenge in software security: the proliferation of vulnerabilities in open-source components that lack active maintenance. Yogu, an Engineering Manager at Canonical responsible for coordinating security support for Ubuntu LTS releases, likens his work to "boiling the neverending ever growing CVE ocean one spoonful at a time." This presentation dives deep into the systemic issues arising from the exponential growth of open-source packages coupled with a stagnant or declining pool of dedicated maintainers, creating a fertile ground for unaddressed security flaws.

The talk highlights how this imbalance leads to a significant security blind spot, where crucial software components become dormant or abandoned, leaving known or easily discoverable vulnerabilities to fester. Yogu argues that while the number of CVEs and packages continues to rise, the critical resource of human maintainership does not keep pace, creating a perilous situation for the vast majority of modern software that relies heavily on open source. He proposes a model for "Vulnerability Responders of Last Resort," suggesting that entities like Linux distributions are uniquely positioned to intervene, coordinate, and mitigate these risks for the collective good.

This issue is paramount because open-source software underpins nearly all modern technology, from operating systems to cloud infrastructure and embedded devices. A single, unaddressed vulnerability in a widely used, yet undermaintained, library can have cascading security implications across countless systems, as famously demonstrated by incidents like the xz utils backdoor attempt. Yogu's talk serves as a call to action, urging the security community to acknowledge this systemic problem and explore collaborative strategies to manage the security debt accumulating in the less visible corners of the open-source ecosystem, thereby strengthening the overall supply chain.

Background

▶ Watch: Introduction to Vulnerability Response of Last Resort (0:00)

The modern software landscape is overwhelmingly built upon open-source components. As Diogo Yogu illustrates, studies, including those from the OpenSSF, consistently show that an "overwhelming, almost complete percentage" of software in use today incorporates open-source elements. This reliance is reflected in the exponential growth of packages across various ecosystems like npm, Maven Central, and even within specific distributions. For instance, Ubuntu's source packages grew from 22,000 in the Trusty LTS release to 37,000 in recent LTS versions over a decade, with projections reaching 39,000 for the upcoming Plucky 25.04. This relentless upward trend in package count is mirrored by the increasing number of GitHub users, which reached 100 million two years ahead of schedule, signifying more people contributing to and consuming open-source projects.

However, Yogu points out a crucial disconnect: while packages and users grow exponentially, the number of dedicated maintainers does not. This scarcity of long-term maintainers is not a new problem; it has plagued open source since its inception. Factors contributing to this include economic pressure, a lack of incentive or support structures, and simply the demands of personal life. The result is a phenomenon Yogu terms "package decay," where older packages, even those that are widely used, fall out of favor, are forked, replaced, or simply abandoned. The speaker cites rsync, a critical utility, as an example of a widely used project with a single maintainer, Andrew, highlighting the precariousness of such a setup.

Compounding this issue is the ever-increasing rate of CVEs being assigned. Data from CVE.org shows a significant jump in assignments from 2023 to 2024, indicating a growing volume of reported vulnerabilities. While more CVEs can be seen as a positive sign of increased security scrutiny, Yogu questions whether this keeps pace with the security needs of the entire ecosystem, especially the "ocean that sits behind that wave" – the older, less-maintained packages. He references a 2012 study on SourceForge projects, which already showed a large number of projects lying dormant. This trend has only intensified, with many GitHub users making one or two contributions before disengaging, leaving codebases unmaintained. The core problem, therefore, is the expanding gap between the sheer volume of open-source components and the human resources available to secure and maintain them, leading to a significant accumulation of unaddressed security debt.

Key Findings

▶ Watch: Ubuntu's package growth over 10 years (2:55)

The central finding of Diogo Yogu's talk is that the burgeoning open-source ecosystem is creating a critical security vulnerability due to the growing number of undermaintained and unmaintained packages. This phenomenon represents a silent but pervasive threat, as these packages often contain security flaws that remain unaddressed, publicly documented, or entirely unknown until exploited.

Yogu illustrates this problem through a comparative analysis of how vulnerability reports are handled across different maintenance levels:

1. Well-maintained packages benefit from established processes, private reporting mechanisms (like GitHub Advisories), efficient triage, and prompt patching, often leading to timely CVE assignments.
2. Undermaintained packages suffer from slower response times, maintainers who may lack the expertise or resources for proper CVE assignment, and a higher risk of public disclosure of vulnerabilities before a fix is ready. False positives might linger due to a lack of motivation to contest them, causing compliance issues later on (e.g., the OpenSSH CVE that maintainers did not consider an issue but appeared in scanners). Crucially, false negatives can result in publicly documented attack vectors in issues or forums that are never revisited or assigned a CVE.
3. Unmaintained packages are the most dangerous, as reports sent to them essentially "hit straight to the void." There is no response, no triage, and no fix, leaving exploitable vulnerabilities in active use without any formal recognition or mitigation path.

A stark example of this "void" is the libSPF2 library, a standard C library for parsing SPF records. Yogu highlighted a use-after-free bug, a critical memory corruption vulnerability, present in an unmerged pull request from 2016 in the project's GitHub repository. This bug, discovered in 2024, had been publicly visible for nearly a decade without resolution, demonstrating how "dragons" can lurk in plain sight. Another example is a giflib vulnerability, assigned a 2025 CVE, which was reportedly "fixed" in 2016 but was not. These cases underscore that "orphan issues" and "orphan projects" are not just theoretical concerns but active repositories of potential zero-day or "10-year day" vulnerabilities.

Yogu debunks common misconceptions: "nobody uses these packages," "people know better than to use abandoned packages," or "I'm sure it's fine." He counters that libSPF2 is the first search result for its function, and often, "no alternatives exist" for critical functionalities. The core finding is that the current vulnerability response mechanisms are ill-equipped to handle the scale and nature of security issues arising from the vast, unmonitored expanse of undermaintained and abandoned open-source components, creating a systemic risk that demands a new approach.

Technical Deep Dive

▶ Watch: The critical lack of open source package maintainers (4:50)

The technical core of Yogu's presentation lies in dissecting the lifecycle of a vulnerability report under different maintenance scenarios, highlighting the breakdown in traditional security response for undermaintained and unmaintained projects. He uses GitHub as the primary example, given its status as a de facto home for most open-source packages.

Consider a security researcher discovering an anomaly and submitting a report—an issue on GitHub, an email, or a direct message.

1. Well-Maintained Package:

• Reporting: Security researchers often use private reporting features (e.g., GitHub Advisories) to disclose vulnerabilities discreetly.
• Triage: A dedicated team or a highly responsive maintainer quickly evaluates the report.
• Verdict: A true positive (a confirmed vulnerability) leads to a coordinated fix, CVE assignment, and a public disclosure only after a patch is ready. A true negative (not a vulnerability) is quickly identified, and the report is closed.
• Speed & Completeness: The process is generally fast and complete, ensuring proper disclosure and resolution.

1. Undermaintained Package:

• Reporting: May be public, exposing the vulnerability before a fix is available, or private but to an unresponsive channel.
• Triage: The single maintainer or small team might lack the time, knowledge, or resources to properly triage. They might not know how to obtain a CVE ID or coordinate a disclosure.
• Verdict:
• True Positive: A fix might eventually be implemented, but the process is slow, potentially public, and might lack proper CVE assignment.
• True Negative: Time to verdict is significantly longer. The maintainer might need to be chased, and the determination that it's "not a security issue" could take weeks.
• False Positive: If a CVE is assigned mistakenly, the maintainer might lack the motivation to contest it, leading to the false positive lingering in vulnerability scanners. Yogu cites OpenSSH as a salient example, where maintainers did not consider a reported issue a security flaw, but it persisted in scanners, creating compliance problems for users.
• False Negative: This is the "worst outcome." A legitimate security issue is dismissed as not a vulnerability. Unlike well-maintained projects where community scrutiny might force a revisit, in an undermaintained project, the issue can "disappear into the void." This leaves a public GitHub issue or similar record fully describing an exploit, ripe for discovery by malicious actors, without any official security advisory or fix.

1. Unmaintained Package:

• Reporting: Reports go directly into "the void"—unanswered emails, unmerged pull requests, abandoned issues. No action is taken.

Yogu provides chilling real-world examples:

• libSPF2: A C library for parsing SPF records, described as "mostly stalled" and "abandoned." A use-after-free bug fix was submitted as an unmerged pull request in 2016. This critical vulnerability, publicly visible for almost a decade, could be picked up by an "ill-intentioned attacker." The challenge here is not just the vulnerability, but the complete lack of a path forward for remediation or official CVE assignment when the maintainer is gone.
• giflib: A 2025 CVE was assigned for an issue reportedly fixed in 2016 but clearly wasn't. This highlights how old, supposedly resolved issues can resurface or were never truly fixed, especially in less scrutinized projects. The interface of SourceForge, where this issue was documented, further emphasizes the age and potential obscurity of such findings.

The speaker emphasizes that "orphan issues" and "orphan projects" are not theoretical. With modern search queries and potential AI-driven crawlers, it's possible to scour old pull requests, forum messages, and mailing lists to uncover these "10-year day" vulnerabilities. These findings challenge the assumption that open-source transparency inherently leads to security; instead, it can expose vulnerabilities without guaranteeing their resolution, especially when maintainership is absent.

Demo / Proof of Concept

▶ Watch: Economic pressure and package decay factors (6:00)

Diogo Yogu's talk is conceptual and analytical, focusing on systemic issues and proposed solutions rather than demonstrating a specific exploit or tool. There was no live demo or proof of concept presented during the talk itself. Instead, the speaker used real-world examples like the libSPF2 and giflib vulnerabilities, along with hypothetical scenarios of vulnerability reporting, to illustrate his points about the challenges posed by undermaintained and unmaintained open-source packages.

Defensive Implications

▶ Watch: Case study: xz backdoor and single maintainer (7:15)

The dire situation presented by undermaintained and unmaintained open-source packages necessitates a proactive and collaborative defensive strategy. Diogo Yogu proposes the concept of "Vulnerability Responders of Last Resort," advocating that established entities like Linux distributions (such as Canonical with Ubuntu) are uniquely positioned to fill this critical gap. Their aggregate knowledge of the ecosystem, widespread package distribution, and existing security support infrastructure make them ideal candidates.

Here's how these "Responders of Last Resort" could bolster defensive postures:

1. Connect Reporters to Maintainers (or Alternatives): When a reporter finds a vulnerability in a seemingly abandoned package, a distro could act as an intermediary. They might know maintainers of forks, alternative implementations, or even the original maintainer's current contact, redirecting reports that would otherwise go into the void.
2. Structure Communication for Actionability: Many reporters, especially those new to security, might not format their findings in a way that is immediately actionable. Responders could help structure these reports, ensuring they contain the necessary technical details for maintainers to understand and address the issue.
3. Assist with Triage and Patching: For undermaintained packages where maintainers lack resources or expertise, distros could lend their security engineering talent to help triage reported issues, develop patches, and even assist with the integration of fixes. This mutual interest ensures the security of components used within their own distributions.
4. Coordinate Disclosure Processes: Navigating CVE assignment, embargo periods, and public disclosure can be complex. Responders could guide maintainers through this process, ensuring vulnerabilities are disclosed responsibly and effectively, preventing premature public exposure.
5. Data Gathering and Identification of Orphaned Projects: A crucial defensive step is to quantify the problem. Distros could lead efforts to gather data on how many actively used packages are truly abandoned or undermaintained. This involves developing criteria to identify "fallen off the grid" packages, acknowledging the difficulty in distinguishing between genuinely abandoned projects and "crystallized" packages that are stable and require no new activity.
6. Develop Alternatives for Critical Components: For essential "crystallized" packages that are undermaintained and cannot be fixed, Responders could proactively develop or identify robust alternatives. This mitigates the risk of a single critical vulnerability in an unmaintained dependency shattering the stability of the ecosystem. The example of libSPF2 highlights this need, as it's a critical component with no clear C-language alternative.
7. Contest False Positives: Distros, with their deep understanding of package behavior, can assist in contesting false positive CVEs that incorrectly flag a package as vulnerable. This reduces the compliance burden on organizations and improves the signal-to-noise ratio for vulnerability scanners.

For organizations consuming open-source software, the implications are clear:

• Deep Dependency Inventory: Go beyond direct dependencies to understand the full dependency tree, including the maintenance status of each component.
• Active Maintenance Assessment: Incorporate maintenance activity (e.g., commit frequency, issue response times, maintainer count) into risk assessments for dependencies.
• Internal Patching Strategy: Be prepared to internally patch critical, but undermaintained, dependencies if an upstream fix is unavailable or delayed.
• Contribution and Funding: Consider contributing resources (code, funding) to critical projects that are undermaintained to ensure their longevity and security.
• Monitor Public Issues: Be aware that publicly available GitHub issues or forum posts can contain descriptions of unpatched vulnerabilities in dependencies.
• Advocate for Last Resort Responders: Support initiatives where distros or similar entities take on the role of vulnerability responders for the broader open-source ecosystem.

Ultimately, defending against this growing threat requires a shift from a reactive, upstream-only approach to a more proactive, collaborative model where shared responsibility across the open-source supply chain is paramount.

Key Takeaways

• The exponential growth of open-source packages significantly outpaces the availability of dedicated maintainers, creating a growing security risk.
• Undermaintained and unmaintained open-source packages harbor unaddressed vulnerabilities, often publicly documented in issues or pull requests, without formal CVE assignment or resolution.
• Traditional vulnerability response processes break down for these packages, leading to slow triage, inadequate patching, and the potential for false negatives to become public attack vectors.
• Entities like Linux distributions are uniquely positioned to act as "Vulnerability Responders of Last Resort," assisting reporters, maintainers, and coordinating disclosures for critical, yet neglected, components.
• Proactive identification of dormant or abandoned packages and the development of robust alternatives for critical functionalities are essential for securing the open-source supply chain.
• Organizations must adapt their vulnerability management strategies to account for the maintenance status of their open-source dependencies, preparing for internal patching or contributing to upstream projects.

About the Speaker(s)

Diogo Yogu is an Engineering Manager at Canonical, based in Portugal. His day-to-day work involves the monumental task of coordinating 12 years of security support for all Ubuntu LTS releases from 2014 onwards, a duty he humorously describes as "boiling the neverending ever growing CVE ocean one spoonful at a time." Outside of his demanding role at Canonical, Yogu is an active member of the security community, serving as an OWASP chapter leader in Lisbon. He is also known for his skills as a cook, a board gamer, and a master of general trivia and cultural references. His insights in this talk are drawn from extensive practical experience at the forefront of open-source vulnerability management.