Improvements to the Identification Process of Vulnerable Components: Deciding About Updates

Applications 1 may contain vulnerabilities for a variety of reasons, one of which is the use of vulnerable components. One of the solutions adopted to eliminate the vulnerabilities inserted by such components is to update the component to a more recent version that corrects the vulnerability. However, updating a component may require code refactoring, updating other components and inserting new vulnerabilities in the application. There are several tools that perform the analysis and management of dependencies of the projects, but few tools present information about vulnerabilities of the new versions, incompatibilities and updates of the dependencies of the components. This article, therefore, presents dep|ct (depict), a tool that aims to identify the known vulnerable components used by the applications and help in the decision on the updating of such components, in order to mitigate the vulnerabilities added to the projects through the vulnerable dependencies. Results of the empirical evaluation carried out on two projects show that the tool can be used to assist in deciding on the update of known vulnerable components.