6 ms·
You can never guarantee that the codepath of a dependency that is vulnerable can not be reached or used as a gadget in an exploit chain. Patching dependencies,
by StrauXX 3mo ago
You can never guarantee that the codepath of a dependency that is vulnerable can not be reached or used as a gadget in an exploit chain. Patching dependencies, even when no direct vulnerability arises is an essential part of defense in depth and sevurity hygene.
- sass_muffin 3mo agoYou can also never guarantee the patched software doesn't include a worse vulnerability, I would submit that patching software without proper time to validate changes is also a security issue. If you aren't careful, that is how you get this security theater.
- jamesfinlayson 3mo agoI don't disagree, though I should have been more specific - I updated dependencies at extremely short notice because that's what security wanted. I would have updated the dependencies sooner or later anyway because I know that periodically updating dependencies is generally a good thing to do.