Open Source Software Scanner

Open source software makes up >80% of applications, but it originates outside the organization, created by tens of thousands of third-party authors. In order to understand the open source software used in their software development efforts, organizations need to know:

• Where open source software is sourced from, and whether that source can be trusted.
• How open source software is being used, and whether that usage contravenes licensing requirements, opening the organization to lawsuits.
• Where open source software is deployed, such as in the back office (internally) or externally, where application security becomes a prime consideration.

The ActiveState Platform is a universal package management solution for Python, Perl and Tcl programming languages that provides organizations with the capabilities of an open source software scanner (OSS scanner):

• Understand which open source components are being used by which development teams
• Identify and remediate open source vulnerabilities
• Identify open source software licenses used in each project

As a result, managers can centrally monitor and track open source software usage across their extended enterprise. ActiveState’s enterprise security solution for open source software scanning offers robust protection for Java applications, empowering security teams to seamlessly identify and mitigate vulnerabilities within scanner software used across various open source projects.

Software Bill of Materials

A BOM identifies all the open source packages and dependencies associated with your application, since you can’t manage what you don’t know you have. The BOM is key to identifying at a glance outliers, issues and errors that require further investigation on a per project basis.

The ActiveState Platform provides organizations with the capabilities of an OSS scanner. It delivers a comprehensive list of ingredients required to build your application, including:

• The version of the programming language for the project (Python, Perl and Tcl)
• Open source packages from the language’s ecosystem, as well as their dependencies
• Transitive dependencies (ie., dependencies of dependencies)
• Shared libraries (ie., OpenSSL, which is shared across all the platforms you support)
• Operating system (OS)-level dependencies
• Configurations (ie., metadata like version number, open source license, etc)
• A Common Vulnerabilities and Exposures (CVE) report, showing vulnerabilities for each component\

A typical BOM might look like the following:

The OSS scanner creates a BOM that not only identifies all packages and dependencies, but also acts as a vulnerability scanner to show which ones have CVEs. Links are provided to the National Vulnerability Database that explain each CVE in detail.

Comply with Security Policies

With the escalating number of open source vulnerabilities reported over the past few years, keeping up with open source vulnerabilities has never been more difficult, or more important as cyber attacks also continue to rise. But the Mean Time To Remediate (MTTR) vulnerabilities is often measured in weeks, if not months. 

The ActiveState Platform not only builds all dependencies from source code for Windows, Linux and Mac, ensuring developers start with a secure development environment, but also provides organizations with the capabilities of a vulnerability scanner to help maintain security over time. The ActiveState Platform can help you reduce MTTR by providing:

• Status updates when your Python, Perl or Tcl environment is vulnerable, similar to GitHub
• A PDF report showing the severity level and details for each vulnerability
• The ability to fix and automatically rebuild your environment with secure open source components in minutes, speeding remediation

Because the ActiveState Platform tracks multiple versions of all your components, you can remediate vulnerabilities at the OS, package and dependency level by simply selecting a non-vulnerable version. The ActiveState Platform can save considerable time and effort by automatically rebuilding your environment, ready to be pulled into your CI/CD pipeline for testing. 

See how the ActiveState Platform acts as a vulnerability scanner and remediation tool in this 2-minute video.

A list of known vulnerabilities can also be generated using the ActiveState Platform’s command line interface (CLI), the State Tool to perform OSS scanning. For DevOps teams leveraging ActiveState’s comprehensive security tools, including vulnerability scanning, scanning applications, various formats, and advanced functionality, our CVE dashboard provides an invaluable resource for real-time insights into potential risks. This enables proactive mitigation strategies and ensures the integrity of open source software projects. Explore our CVE dashboard [here](https://www.activestate.com/resources/data-sheets/datasheet-enterprise-wide-vulnerability-dashboard/) for enterprise-wide vulnerability management.

Comply with Licensing Policies

Legal teams implement open source licensing policies to ensure against IP infringement and lawsuits. But identifying the licenses associated with every open source component in your application can be difficult, since:

• Without a complete open source software bill of materials, you may miss some open source component and their licenses
• Components may have no stated license, increasing the risk of utilizing them
• Components may contain sub-components that have conflicting licenses, making it difficult to understand whether the overall license complies with your policy

The ActiveState Platform can help you mitigate license risk by acting as an OSS scanner to create a complete bill of materials, and the licenses associated with them. You can use the ActiveState Platform’s API to programmatically retrieve and identify the licenses associated with every open source component in a project’s codebase, allowing you to automate open source license compliance. 

For example, running a license API query on our ActivePython project returns:

Ready to see for yourself? You can try the ActiveState Platform by signing up for a free account using your email or GitHub credentials. Or sign up for a free demo and let us show you how you can improve compliance and security without disrupting your development efforts.

Frequently Asked Questions