Abstract: An automated identification of vulnerable software components is presented. The objective to find a method for the automatic identification of CVE affected software components through source-code parsing and text analysis. The method shall reduce manual work to a minimum and ensure a high level of data quality. The objective is solved by the computer-implemented method for identifying vulnerable software, comprising: receiving a software package; unpacking source code files for multiple versions of the software package; retrieving an entry for the software package from a vulnerability database; retrieving a patch for the software package; determining changes made by the patch to source code files of the software package; and determining whether the changes were made to a given version of software and reporting the given version of software as vulnerable in response to a determination the changes were absent from the given version of software.

Abstract: A computer-implemented method is presented for identifying vulnerable software from a computer system. The method includes: identifying name of a given software component in a vulnerability database by analyzing text of an entry in the vulnerability database using a large language model, where entries in the vulnerability database have known vulnerabilities; identifying a patch for the given software component in a source code repository by analyzing text of the entry in the vulnerability database using the large language model; identifying the patch for the given software component in the source code repository by analyzing text in the source code repository using the large language model; and reporting the given software component as being vulnerable in response to identifying the patch for the given software component in the source code repository.