I use an ancient library to perform some math. It's been working just fine for more than 10 years without any need for update. Can someone explain why is it insecure and what updates are needed to complex algos to make them so? When looking at the code it is pure computation.

I think what you are saying is simply FUD when taken as a blanket statement.

> I use an ancient library to perform some math.

Anyone can cherry-pick examples to try to disprove a security principle. A pure, functional math library isn't representative of the vast, vast majority of libraries that are imported every day.

The most-used libraries across languages are for things like database access, logging, package management, HTTP, and (de)serialization. All of those things need to be kept updated for security.

> Can someone explain why is it insecure and what updates are needed to complex algos to make them so? When looking at the code it is pure computation.

You didn't specify the language or library.

Most libraries that people import are going to be JS, just because of the number of JS users and the minimal standard library in that language. Many are also going to operate on user input, which means they can have vulnerabilities.

The mathjs package in NPM, for example, has had tons of vulnerabilities[1].

1. https://security.snyk.io/package/npm/mathjs

C++ Library, forgot the name, need to look.

NPM system is security abomination I agree. But I am not using it. I look at things from my own perspective. If 90% of the world programmers are bound to NPM ecosystem (doubt it) it is their problem. Not mine. I do not "import" half of the Internet for my "hello worlds".

Are you passing user input into it? Does it interact with anything on the system? Poorly sanitized inputs present a very serious risk for RCE vulnerabilities.

As already said it is pure computational lib. It does not interact with anything and I use it from my code. There are tons of libraries like this. They work just fine, do not pose a security risk and have no need for update.

But thanks for trying anyways.

Updates may be a security threat too… didn’t log4j become a security treat _because_ it had been updated?