How to Identify and Mitigate Vulnerable OSS Packages in Your Repository

You can use JFrog Catalog to find vulnerable open-source software (OSS) packages in a repository, compare versions, and update your build to a safer version or a patch.

To identify and mitigate vulnerable OSS packages:

1. Navigate to JFrog Catalog Search.
2. Enter a package name or version, for example log4j.
3. Filter by package type, for example Maven, npm, or PyPI.
4. Open the Vulnerabilities tab and review the Common Vulnerabilities and Exposures (CVE) details.
5. Check whether each CVE comes from a dependency or from the package itself.
6. Click the CVE to view the JFrog Security Research mitigation guidance.
7. Compare versions or alternative packages. For the comparison workflow, see How to Compare and Select the Best OSS Package for Your Project.
8. Look for a version with no critical vulnerabilities.
9. Update the package:
   • If a secure version is available, update your build to use that version.
   • If no secure version is available, apply the patches described by JFrog Security.

Related Topics

• Catalog
• How-Tos
• How to Compare and Select the Best OSS Package for Your Project