This Shit is Hard: Building a vulnerability database from private reports

When a vulnerability is reported in an open source dependency, your team needs to know whether the version you run is affected and what update addresses it. A finding against one release does not answer those questions for everyone using other versions of the package. Athena brings together vulnerability findings from across the industry so coalition members can coordinate remediation, mitigations, and disclosure. Most of these findings arrive before a public advisory or upstream fix exists. To date, Athena has validated 21,175 zero-day vulnerabilities. Turning those findings into information that guides remediation requires understanding which defect each report describes, where it exists, and what has already been done to address it. Consider two reports about the same package. One describes a vulnerability in an older release; the other describes similar behavior in the latest version but points to a different function. They could be separate vulnerabilities, or two paths to the same one. An upstream change may already fix…