Dependency vulnerabilities
What it is
Dependency vulnerabilities are security weaknesses found in third-party libraries, packages, and tools that your application pulls in — either directly or transitively (dependencies-of-dependencies). Because modern apps are mostly composed of open-source components, an unpatched dependency can give an attacker the same access as a flaw in your code.
Why it exists
You rarely write the whole stack; you consume packages (NuGet, npm, PyPI, Maven, Go modules) and base images. Each has its own known vulnerabilities (CVEs). Without tracking them, an app can ship with a critical, patched-elsewhere flaw that attackers exploit — the software supply chain is a primary attack surface, which is why scanning dependencies is an AZ-400 security focus.
Key ideas
- Direct vs transitive — you control the direct ones; transitive ones (nested deps) are also scanned by tooling.
- CVE / advisory databases — tools cross-reference package versions against known-issue feeds (e.g. GitHub Advisory Database, OWASP Dependency-Check, NuGet/npm advisories).
- Automated detection & remediation — tools flag the vulnerable package and suggest/auto-raise the fix (e.g. Dependabot opens a PR to bump the version).
- Version pinning / lockfiles — lock files (package-lock.json, packages.lock.json) make the resolved set deterministic and thus scannable.
- Feed a gate — fail the build or block the release when a critical dependency violation exists (a compliance gate).
- Pair with SCA — dependency/vulnerability scanning is the security dimension of supply-chain component analysis; dependency management covers feeds and versioning.
How it fits
One pillar of shift-left security: automation patches risky components at the point of change instead of leaving a “known-unsafe dependency” liability in released builds. Works alongside SAST (your code), DAST (runtime) and SCA (components).
Exam notes
- Distinguish SAST (your code) vs dependency/vuln scanning (third-party components) vs SCA/llicense (component inventory + legal).
- Memorize the tool: Dependabot (GitHub) auto-opens PRs for vulnerable dependencies; Azure DevOps integrates Open Source / vulnerability scanning with Azure Artifacts.
- Watch for transitive dependencies — tooling must scan the full graph, not just directly-referenced packages.
- Vulnerable package found late → prefer update + redeploy via automated PR; the finding should gate the release.
Related
dev-sec-ops · software-composition-analysis · compliance-gate · dependency-management · azure-artifacts