2025年度开源安全和风险分析报告英文版.pdfVIP

2025OpenSourceSecurity

andRiskAnalysisReport

Tableofcontents

Welcometothe2025OSSRAReport1

WhoShouldReadThisReport1

WhatYou’llLearnandWhyItMatters2

AboutThisReport’sDataandBlackDuckAudits3

OurFindingsataGlance4

LookingatOpenSourceRiskandVulnerabilities7

SoftwareSecurityBeginswithVisibilityintoYourCode7

UnderstandingRiskManagementandGainingVisibilityintoYourCode8

EnhancingSoftwareSecurityandTransparencywithSCAandSBOMs8

AnalyzingtheImpactofaVulnerability11

Log4jandEquifax:TwoLessonsontheNeedforVisibilityintoYourCode12

TheTopHigh-andCritical-RiskVulnerabilities13

WhattheDataTellsUs18

Industry-SpecificInsights18

OpenSourceLicensing19

HowConflicts,Variants,andLackofLicensesCreateRisk19

TheImpactofTransitiveDependenciesonLicenseConflicts20

TheTop10OpenSourceLicensesof202420

WhatArePermissive,WeakCopyleft,andReciprocalOpenSourceLicenses?21

HowtoManageOpenSourceLicenseRiskwithSCA21

IndustryPerspectivesonLicenseConflicts22

IfYouAnticipateanMA23

MaintenanceandOperationalFactorsImpactingRisk25

Conclusion:TheMoreThingsChange27

KeyRecommendations28

Welcometothe2025OSSRAReport

Opensourcesoftware(OSS)hasrevolutionizedapplicationdevelopment,providingavastrepository

ofprebuiltcomponentsthatoffernumerousbenefitssuchascostsavings,flexibility,andscalability.

However,withallthosebenefitscomesrisksthateveryorganizationusingopensourceneedstobe

preparedtoacknowledgeandaddress.

The2025“OpenSourceSecurityandRiskAnalysis”(OSSRA)reportdetailskeyfindingsfromBlack

®

Duckauditdata,includingsecurityvulnerabilities,licensingissues,componentmaintenance,

andindustrytrends.Ouranalysisshowsthatopensourceisubiq