Software Architect's Handbook

Using components with known vulnerable components

Applications may consist of a variety of components, including third-party libraries and frameworks. A vulnerability in any of these components can compromise the overall security of the application.

Development teams must be aware of existing vulnerabilities in the components they are using, keep up with the latest announcements of new vulnerabilities, and apply patches and/or new versions that will fix vulnerabilities. If there are any unused dependencies or components, then they should be removed to reduce the possibility of exploits.

When obtaining components and libraries, be sure to get them from official sources and over secure links, or you will be inviting the possibility that such ...