Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

2
  • Huh interesting. So if I build my libraries from source, vulnerability scanners are useless against them? Are there any tools that can discover vulnerabilities in shared libraries? Commented Aug 17, 2021 at 17:02
  • @ArtemA. Ask yourself how would a scanner identify a library version? There is no common standard to encode a version into a library. Some may contain the version as string and export a function returning it. Other libraries have no version string included and detecting a version based on compiled code is difficult as there are quite a few compilers available with a large number of options changing the compiled output and last but not least each compiler is available in multiple versions for different architectures. Hence collecting hashes of libraries is next to useless. Commented Aug 17, 2021 at 17:53