Towards Unveiling Vulnerability Remediation Tactics from OSS Community

In the rapidly evolving landscape of software development, addressing security vulnerabilities in open-source software has become highly important. However, existing research and tools from both academia and industry mainly relied on limited solutions, such as vulnerable version adjustment and adopting patches, to handle identified vulnerabilities. However, far more flexible and diverse countermeasures have been actively adopted in the open-source communities, which potentially complement the traditional remediation tactics provided by modern vulnerability databases. To this end, we conducted an empirical study to unveil the remediation tactics used in the GitHub community towards CVEs. Then we compared the tactics with those from modern vulnerability databases to underscore a critical gap in modern vulnerability databases, where 54 % of CVEs lack fixing suggestions. This gap can be significantly mitigated by leveraging the 93 % of actionable solutions provided through GitHub issues.