Learning to Catch Security Patches

Understand

Timely patching is paramount to safeguard users and maintainers against dire consequences of malicious attacks.

• In practice, patching is prioritized following the nature of the code change that is committed in the code repository.
• When such a change is labeled as being security-relevant, i.e., as fixing a vulnerability, maintainers rapidly spread the change and users are notified about the need to update to a new version of the library or of the application.
• Unfortunately, oftentimes, some security-relevant changes go unnoticed as they represent silent fixes of vulnerabilities.