Lightwell project filters out 400 Java library vulnerabilities
IBM and Red Hat's Lightwell says it found more than 400 new vulnerabilities in widely used Java libraries.
IBM and Red Hat's Lightwell initiative says it has identified more than 400 previously undiscovered vulnerabilities in widely used Java libraries and is inviting customers to submit dependencies to a new Lightwell Clearinghouse. As an example of the bugs it seeks, the companies cite an April critical sandbox bypass in the Thymeleaf template engine with a CVSS score of 9.1; the article names no CVE identifiers. IBM and Red Hat said in May they would commit 20,000 engineers and $5 billion, combining open-source work with AI-assisted remediation. Azul separately offers free Java vulnerability assessments aimed at blind spots that automated exploitation tools such as Mythos can find.
- Lightwell claims more than 400 previously unknown Java library flaws.
- Cites an April Thymeleaf sandbox bypass scored CVSS 9.1, with no CVE named.
- IBM and Red Hat previously pledged 20,000 engineers and $5 billion.
- New Clearinghouse will review customer dependencies and backport fixes.
Full article248 words · extracted from csoonline.com · click to collapse
Lightwell, the open-source security initiative set up by IBM and Red Hat, has identified more than 400 previously undiscovered vulnerabilities in widely used Java libraries — and now the companies are inviting customers to submit their own code dependencies to a new service, Lightwell Clearinghouse, for review.
They’ll be looking for bugs such as the critical sandbox bypass in Java template engine Thymeleaf, with a CVSS score of 9.1, discovered in April.
“AI agents shifted the threat landscape overnight, exploiting old dependencies at machine speed. Finding those bugs is only half the battle: the real work is backporting fixes directly into active production apps so customers do not have to pick between security and uptime. Finding and neutralizing 400+ novel vulnerabilities so quickly shows how fast Lightwell can move,” said Gunnar Hellekson, vice president and general manager of Lightwell.
IBM and Red Hat announced in May that they would commit 20,000 engineers and $5 billion to the Lightwell project, combining their open-source engineering expertise, Red Hat’s community relationships, and AI-assisted engineering workflows. Their goal is not just to identify security issues, but also to introduce remediation software to address them.
Lightwell is not the only player in town when it comes to identifying and fixing Java vulnerabilities. Azul has introduced free vulnerability risk assessment for Java Virtual Machines. The company said it can address the blind spots that autonomous AI-powered exploitation tools, like Mythos, are able to find.
This article first appeared on InfoWorld.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.csoonline.com/article/4233240/lightwell-project-filters-out-400-java-library-vulnerabilities-2.html