Question

During a software composition analysis, a development team discovers that a widely used open-source library embedded in their production application has a newly disclosed critical vulnerability. The library is maintained by volunteers, and no patched version is currently available. Management asks the risk practitioner to recommend the MOST appropriate first action to address the risk.

Accepted Answer

Assess how the vulnerable component is used within the application to determine actual exposure and applicable compensating controls

Answer

Immediately remove the library from the codebase and halt the application until a replacement is found

Answer

Accept the risk formally since no vendor patch is available and the library is community-maintained

Answer

Document the vulnerability in the risk register and defer action until the maintainers release a fix