Code vulnerability detection and validation

A system comprising:

• a data repository storing a vulnerable code section record;
• and
• at least one processor for executing instructions for performing operations comprising:
• obtaining a set of patches from at least one code repository for a vulnerability record of a vulnerability of a software component,
• applying the set of patches to obtain a modified set of code files modified by the set of patches,
• inferring a vulnerable code section set according to the modified set of code files, wherein the vulnerable code section set is a subset of the modified set of code files,
• obtaining a vulnerable version list of a plurality of versions of the software component comprising the vulnerability,
• validating a version in the vulnerable version list as having the vulnerable code section set,
• storing the vulnerable code section set in the vulnerable code section record, and
• processing a target software comprising the version using the vulnerable code section record.

A non-transitory computer readable medium comprising computer readable program code for performing operations comprising:

• obtaining a set of patches from at least one code repository for a vulnerability record of a vulnerability of a software component;
• applying the set of patches to obtain a modified set of code files modified by the set of patches;
• inferring a vulnerable code section set according to the modified set of code files, wherein the vulnerable code section set is a subset of the modified set of code files;
• obtaining a vulnerable version list of a plurality of versions of the software component comprising the vulnerability;
• validating a version in the vulnerable version list as having the vulnerable code section set;
• and
• processing a target software comprising the version using the vulnerable code section set.