Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces a conceptual framework for understanding the distributed nature of vulnerability management in the open-source ecosystem, highlighting how information exchange and transformation contribute to inconsistencies in vulnerability scanner results. By tracing the lifecycle of vulnerability information—from creation and standardization to context-dependent interpretation—the authors identify key factors such as heterogeneous sources and divergent models that lead to reporting discrepancies. The findings underscore the need for improved methodologies in evaluating and interpreting vulnerability data, which is crucial for enhancing software supply chain security.
Divergent vulnerability scanner results stem from a complex web of information exchange and transformation, not just from individual tools or data sources.
Identifying known software vulnerabilities is a central task in software supply chain security management. Although publicly available vulnerability information is based on shared standards, different vulnerability scanners often report divergent results for identical software inventories. These differences do not arise solely from individual data sources or scanner implementations. They can emerge at several stages of the open-source vulnerability ecosystem. This paper presents a conceptual framework that describes vulnerability management as a distributed process of information exchange and transformation. It traces vulnerability information from its creation and standardization through enrichment to context-dependent interpretation. The analysis identifies heterogeneous information sources, divergent identity and version models, temporal change, and context-dependent assessment as major causes of inconsistent scanner findings. It then discusses the implications for interpreting analysis results, designing reproducible evaluation methods, and handling dynamic vulnerability knowledge in practice.