
De G2
Software Supply Chain Security: What CVE Scanners Miss
NOUVEAU
The Common Vulnerabilities and Exposures (CVE) scan passes. And thankfully, no critical CVEs were found. The dashboard stays green, which means that everything looks good enough to ship. Why not? That is the default. A clean scan becomes shorthand for acceptable risk.That is the default. A clean scan becomes shorthand for acceptable risk. Most software supply chain security failures do not start with a missing patch. They start with trust assumptions that automated scanners were never built to question.However, some of the most damaging attacks in recent years never triggered a CVE alert at all. In the SolarWinds attack, malicious code was injected into the build pipeline and shipped as a trusted update, without any CVE to flag it.Compromised packages, malicious maintainer updates, and poisoned build pipelines often operate outside vulnerability databases. Your scanner isn’t designed to see them.So now, let me ask you a difficult question. If your pipeline only measures known vulnerabilities, how confident are you about the software you actually trust to build and ship your product?
Lire la suite