A large multi-language dataset of open-source software vulnerabilities and their fixes

Abstract

In the current scenario of progressive increase in the adoption of digital tools by society, software of all types and sizes constantly faces threats to its security. In the context of digital security, a vulnerability is defined as a weakness found in software and hardware components that, when exploited, negatively impact the service’s confidentiality, integrity, or availability. The process of mitigating security vulnerabilities present in software typically involves code changes. Therefore, it is necessary to identify the snippet of code that introduces a vulnerability to implement the correction. This work presents a methodology for identifying and extracting vulnerable codes in open-source software projects and their patches. For this purpose, a tool is presented that identifies published software vulnerabilities and automatically extracts the associated code. The constructed dataset combines software vulnerabilities and their fixes in 3,587 projects developed in 58 programming languages. Furthermore, analyses were carried out to verify the incidence of vulnerabilities and the characteristics of fixes developed in the main languages on the market.