US 12,189,788 B2
Identifying and addressing potential vulnerabilities in third-party code
Henrik Plate, Valbonne (FR); Dimitrios Styliadis, San Jose, CA (US); and Alexandre Wilhelm, Kilauea, HI (US)
Assigned to Endor Labs Inc, Palo Alto, CA (US)
Filed by Endor Labs Inc, Palo Alto, CA (US)
Filed on Jun. 12, 2024, as Appl. No. 18/740,976.
Claims priority of provisional application 63/552,793, filed on Feb. 13, 2024.
Claims priority of provisional application 63/472,561, filed on Jun. 12, 2023.
Claims priority of provisional application 63/472,562, filed on Jun. 12, 2023.
Claims priority of provisional application 63/472,557, filed on Jun. 12, 2023.
Prior Publication US 2024/0411897 A1, Dec. 12, 2024
Int. Cl. G06F 21/57 (2013.01); G06F 21/62 (2013.01); G06F 21/55 (2013.01); G06F 21/56 (2013.01)
CPC G06F 21/577 (2013.01) [G06F 21/6218 (2013.01); G06F 21/552 (2013.01); G06F 21/565 (2013.01)] 17 Claims
OG exemplary drawing
 
1. A computer-implemented method, executed by one or more processors, comprising:
receiving a security advisory that include a description of a vulnerability;
accessing a version control system (VCS) used by a third-party library;
determining additional resources related to the vulnerability;
determining a set of code changes performed by project maintainers in the VCS;
identifying one or more fix commits that address the vulnerability;
identifying one or more functions with the vulnerability that have been changed by the one or more fix commits, wherein identification of the one or more functions with the vulnerability includes:
comparing one or more files corresponding to the one or more functions before and after a code change was made, and
identifying individual functions of the one or more functions that included the vulnerability and that have been modified to address the vulnerability;
performing a search for components and component versions that include the one or more functions with the vulnerability;
generating an enriched vulnerability description that includes identifiers of package versions that include:
fixed versions of the one or more functions; and
vulnerable version of the one or more functions; and
modifying project code in a development system to use the fixed versions of the one or more functions.