Prioritizing patching of vulnerable components

1. A computer-implemented method comprising:

obtaining information indicative of a first set of components embedded in a software package;

obtaining a data flow representation generated for the software package, wherein the data flow representation is indicative of a second set of components embedded in the software package;

determining risk levels for respective ones of the components in the first set based on the data flow representation of the software package, wherein the determining the risk level for a given component in the first set comprises: (i) verifying that the second set of components comprises the given component and (ii) determining, from the data flow representation, that the given component in the first set both receives input data that originates from an external source, relative to the given component, and one or more of: reads and writes sensitive data; and

assigning a priority for patching a software vulnerability in the given component of the first set based at least in part on the risk level of the given component;

wherein the method is performed by at least one processing device comprising a processor coupled to a memory.

2. The computer-implemented method of claim 1 , wherein the verifying comprises:

verifying that the second set of components comprises each component in the first set.

3. The computer-implemented method of claim 2 , wherein the data flow representation of the software package is generated based on one or more of a static analysis and a threat-model analysis.

4. The computer-implemented method of claim 1 , wherein the obtained information is generated using a software composition analysis mechanism.

5. The computer-implemented method of claim 1 , wherein each of the risk levels comprises a modifier value based on one or more characteristics of the corresponding component in the data flow representation.

6. The computer-implemented method of claim 5 , wherein the one or more characteristics comprise at least one of:

whether or not the component enforces a security control;

whether or not the component received a tainted input data flow;

whether or not the tainted input data flow originates from a trusted user;

whether or not sensitive information is read;

whether or not sensitive information is written;

whether or not the component spawns a process that reads and/or writes sensitive information;

whether or not the component communicates with a process that reads and/or writes sensitive information;

whether or not the component is hardened to reduce an attack surface; or

whether or not the component is deployed in a least privilege manner.

7. The computer-implemented method of claim 5 , wherein assigning the priority for patching the software vulnerability in the given component comprises:

adjusting a score associated with a type of the software vulnerability by the modifier value of the given component.

8. The computer-implemented method of claim 1 , wherein the information comprises a software bill of materials, and wherein the method comprises augmenting the software bill of materials with the determined risk levels.

9. A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device:

to obtain information indicative of a first set of components embedded in a software package;

to obtain a data flow representation generated for the software package, wherein the data flow representation is indicative of a second set of components embedded in the software package;

to determine risk levels for respective ones of the components in the first set based on the data flow representation of the software package, wherein the determining the risk level for a given component in the first set comprises: (i) verifying that the second set of components comprises the given component and (ii) determining, from the data flow representation, that the given component in the first set both receives input data that originates from an external source, relative to the given component, and one or more of: reads and writes sensitive data; and

to assign a priority for patching a software vulnerability in the given component of the first set based at least in part on the risk level of the given component.

10. The computer program product of claim 9 , wherein the verifying comprises: verifying that the second set of components comprises each component in the first set.

11. The computer program product of claim 10 , wherein the data flow representation of the software package is generated based on one or more of a static analysis and a threat-model analysis.

12. The computer program product of claim 9 , wherein the obtained information is generated using a software composition analysis mechanism.

13. The computer program product of claim 9 , wherein each of the risk levels comprises a modifier value based on one or more characteristics of the corresponding component in the data flow representation.

14. The computer program product of claim 13 , wherein the one or more characteristics comprise at least one of:

whether or not the component enforces a security control;

whether or not the component received a tainted input data flow;

whether or not the tainted input data flow originates from a trusted user;

whether or not sensitive information is read;

whether or not sensitive information is written;

whether or not the component spawns a process that reads and/or writes sensitive information;

whether or not the component communicates with a process that reads and/or writes sensitive information;

whether or not the component is hardened to reduce an attack surface; or

whether or not the component is deployed in a least privilege manner.

15. The computer program product of claim 13 , wherein assigning the priority for patching the software vulnerability in the given component comprises:

adjusting a score associated with a type of the software vulnerability by the modifier value of the given component.

16. The computer program product of claim 9 , wherein the information comprises a software bill of materials, and wherein the at least one processing device is further caused to augment the software bill of materials with the determined risk levels.

17. An apparatus comprising:

at least one processing device comprising a processor coupled to a memory;

the at least one processing device being configured:

to obtain information indicative of a first set of components embedded in a software package;

to obtain a data flow representation generated for the software package, wherein the data flow representation is indicative of a second set of components embedded in the software package;

to determine risk levels for respective ones of the components in the first set based on the data flow representation of the software package, wherein the determining the risk level for a given component in the first set comprises: (i) verifying that the second set of components comprises the given component and (ii) determining, from the data flow representation, that the given component in the first set both receives input data that originates from an external source, relative to the given component, and one or more of: reads and writes sensitive data; and

to assign a priority for patching a software vulnerability in the given component of the first set based at least in part on the risk level of the given component.

18. The apparatus of claim 17 , wherein the verifying comprises:

verifying that the second set of components comprises each component in the first set.

19. The apparatus of claim 18 , wherein the data flow representation of the software package is generated based on one or more of a static analysis and a threat-model analysis.

20. The apparatus of claim 17 , wherein the obtained information is generated using a software composition analysis mechanism.