Many organizations are still struggling to identify and manage open source risk across their application portfolios, according to the Open Source Security & Risk Analysis (OSSRA) report.

The report says, "while the number of vulnerabilities in open source is small compared to proprietary software, over 7,000 open source vulnerabilities were discovered in 2018 alone. Over 50,000 have emerged over the past two decades."

The report highlights the persisting challenges organizations face when it comes to managing open source risk, including:

• A rise in the average number of open source components detected in each codebase, with more than 298 open source components on average found. Those using open source often overlook associated security and license risks.
• Another record year for number of open source vulnerabilities disclosed in the NVD. 60 percent contained at least one open source vulnerability and 68 percent contained components with license conflicts, the report says.
• An increase in the average age of open source vulnerabilities detected, with more than 40 percent of code bases containing a vulnerability that was disclosed more than a decade ago.
• Over 40 percent of codebases contain a high-risk vulnerability.

Despite these challenges, the 2019 OSSRA data suggests that, in the wake of the Equifax breach, an increase in awareness of open source risk and the maturation of commercial software composition analysis solutions has led to forward progress, including: 

• The percentage of codebases that contain vulnerable components have decreased.
• The percentage of codebases that contain license conflict have decreased.