Abstract:  In recent years, with the continuous shortening of the software development cycle, a large number of open source code is used in modern software projects, and software developers tend to focus only on the security of the part of the project code they are responsible for, and rarely pay attention to the security of the open source code used in the project, and it is difficult for users to correspond the vulnerability entries in the traditional vulnerability repository to the current software version. and existing vulnerabilities There are some differences between existing version control schemes and those of open source code, so a vulnerability repository that can accurately collect open source code vulnerability intelligence and precisely match vulnerabilities is essential. This paper first introduces the potential security challenges brought by the widespread use of open source code, then analyzes in detail the existing open source vulnerability repository platforms and conducts a comparative study of existing open source vulnerability databases from several dimensions, then gives the problems and challenges faced by the construction of current open source vulnerability databases, and finally gives some suggestions for building open source vulnerability databases.

Key words: open source code, vulnerability database , version control , open source vulnerability intelligence, open source vulnerability database

摘要： 近年来，随着软件开发周期的不断缩短，越来越多的软件开发者在其项目代码中使用大量的开源代码，软件开发者往往只关注自己负责部分的代码安全，几乎不关注项目采用的开源代码的安全性问题，开源软件的使用者很难将传统漏洞数据库中的漏洞条目对应到当前的软件版本中，现有的漏洞版本控制方案和开源代码的版本控制方案之间存在一定的差异，这使得开源代码使用者无法及时修复存在漏洞的代码，因此一个能够准确收集开源漏洞情报并对漏洞进行精确匹配的漏洞库是十分必要的．本文首先介绍了开源代码的广泛使用带来的潜在安全挑战，其次对现有开源漏洞库平台的情况进行了详细分析，同时对现有开源漏洞库从多个维度进行了对比研究，然后给出了当前开源漏洞库建设面临的问题和挑战，最后给出了建设开源漏洞数据库的一些建议．

关键词: 开源软件, 漏洞数据库, 版本控制, 开源漏洞情报, 开源漏洞库