CWE一覧に戻る
CWE-1395

脆弱なサードパーティコンポーネントへの依存

Dependency on Vulnerable Third-Party Component
脆弱性 作成中
JA

この製品には、1 つ以上の既知の脆弱性を含むサードパーティ製コンポーネントへの依存関係があります。

多くの製品は、その機能の一部に、製品の開発者ではないサードパーティが開発したライブラリやモジュール、その他の知的財産を使用するほど、大規模または複雑です。例えば、ハードウェア製品では、オペレーティング・システム全体がサード・パーティのサプライヤーのものである場合もあります。オープンソースであろうとクローズドソースであろうと、これらのコンポーネントには、製品を侵害するために敵に悪用される可能性のある公知の脆弱性が含まれている可能性があります。

EN

The product has a dependency on a third-party component that contains one or more known vulnerabilities.

Many products are large enough or complex enough that part of their functionality uses libraries, modules, or other intellectual property developed by third parties who are not the product creator. For example, even an entire operating system might be from a third-party supplier in some hardware products. Whether open or closed source, these components may contain publicly known vulnerabilities that could be exploited by adversaries to compromise the product.

Scope: Confidentiality, Integrity, Availability / Impact: Varies by Context
In some industries such as healthcare [REF-1320] [REF-1322] or technologies such as the cloud [REF-1321], it might be unclear about who is responsible for applying patches for third-party vulnerabilities: the vendor, the operator/customer, or a separate service. Clarifying roles and responsibilities can be important to minimize confusion or unnecessary delay when third-party vulnerabilities are disclosed.
Require a Bill of Materials for all components and sub-components of the product. For software, require a Software Bill of Materials (SBOM) [REF-1247] [REF-1311].
Maintain a Bill of Materials for all components and sub-components of the product. For software, maintain a Software Bill of Materials (SBOM). According to [REF-1247], "An SBOM is a formal, machine-readable inventory of software components and dependencies, information about those components, and their hierarchical relationships."
Actively monitor when a third-party component vendor announces vulnerability patches; fix the third-party component as soon as possible; and make it easy for operators/customers to obtain and apply the patch.
Continuously monitor changes in each of the product's components, especially when the changes indicate new vulnerabilities, end-of-life (EOL) plans, etc.
MITRE公式ページ — CWE-1395