段夕华：不知道 21 年底所爆发的 log4j 漏洞，是否会让公司购买开源产品更加保守谨 慎？开源安全任重而道远。 Duan Xihua: I wonder if the log4j vulnerability in late 2021 will make companies more conservative and cautious in buying open source products of the top 10 seats. 2.8 开源安全与合规 Open Source Security and Compliance 2.8.1 CVE 漏洞风险 CVE Vulnerability Risks Gitee 采用棱镜七彩 FossEye 静态扫描了 1.5 万 个 Gitee 平台上具有代表性的优质推荐开 源项目仓库，结果显示有超过 93% 不存在 CVE 漏洞风险。 51%，存在超 过 10 个 CVE 漏洞的占比 2.58%。 Of the projects with CVE vulnerabilities, 18.51% have one CVE vulnerability, and 2.58% have more than 10 CVE vulnerabilities. 2.8.3 开源合规情况 Open Source Compliance

疑配置选项等安全配置问题进行全面检查的能 力。借助Trivy，用户能够轻松地进行容器镜像 的安全评估和漏洞修复工作。 近日，Trivy v0.41.0发布，版本特性更新如下： • 支持使用Vulnerability Exploitability Exchange（VEX）对检测到的漏洞进行 过滤； • 支持为虚拟机镜像生成CycloneDX和SPDX 等格式的SBOM（软件物料清单）； • 支持嵌套JAR路径；

9C27B31342B7511D. Note We’re heavily depending on third party components for many things. In case you find vulnerability which is affecting those components in general, please report it directly to them. See following

9C27B31342B7511D. Note: We’re heavily depending on third party components for many things. In case you find vulnerability which is affecting those components in general, please report it directly to them. See following

9C27B31342B7511D. Note: We’re heavily depending on third party components for many things. In case you find vulnerability which is affecting those components in general, please report it directly to them. See following

9C27B31342B7511D. Note We’re heavily depending on third party components for many things. In case you find vulnerability which is affecting those components in general, please report it directly to them. See following

9C27B31342B7511D. Note We’re heavily depending on third party components for many things. In case you find vulnerability which is affecting those components in general, please report it directly to them. See following

9C27B31342B7511D. Note: We’re heavily depending on third party components for many things. In case you find vulnerability which is affecting those components in general, please report it directly to them. See following

9C27B31342B7511D. Note We’re heavily depending on third party components for many things. In case you find vulnerability which is affecting those components in general, please report it directly to them. See following

9C27B31342B7511D. Note: We’re heavily depending on third party components for many things. In case you find vulnerability which is affecting those components in general, please report it directly to them. See following