Lesson 5.11: Vulnerable and outdated components
Most of a web application is code its developers didn't write: the operating system's packages, the language runtime, libraries from package managers and JavaScript copied into the site. Each can have known vulnerabilities with public CVEs. How to keep an inventory, match it against advisories, patch the system with the package manager, update or remove libraries, and why a distribution's patched PHP can still say 8.3.6. In the lab you install pending PHP security updates and restart PHP-FPM, check the shop's PHP libraries and an old copy of jQuery against advisories, and remove the library nobody uses.
18 min
You will learn to
- Explain why components are part of the attack surface
- Find pending security updates and install them
- Restart a service so it runs the patched code
- Match library versions against advisories (CVE)
- Remove unused components
Key terms
- Component
- Any software the application depends on: operating system packages, runtimes, frameworks, libraries, front-end scripts.
- CVE
- Common Vulnerabilities and Exposures: a public ID for one known vulnerability.
- Security advisory
- A notice from a vendor or project naming affected versions, the fixed version and the CVEs.
- Lock file
- A file recording the exact versions of all installed libraries.
- Software composition analysis (SCA)
- Tools that list an application's components and match them against advisory databases.
- Backport
- Applying a security fix to an older version without upgrading to the newest release.
← Remote access, and the protocols that send passwords in the clear · All lessons · Computer crime law: what is illegal almost everywhere →