Access and Feeds
blog-alfresco

The most popular and comprehensive Open Source ECM platform

Let us know more

Security: Open Source and Vulnerabilities

Home › Security: Open Source and Vulnerabilities

By Dick Weisinger

Open Source software and security. Are Open Source projects security focused and how nimble are they in addressing reported vulnerabilities?

With more than 300 projects, one of the biggest Open Source groups is the Apache Software Foundation (ASF). Apache software includes Hadoop, Tomcat, Kafka, Lucene, POI, and Zookeeper. The foundation publishes an annual report of security issues that have been reported and addressed for their software products.

The ASF report summarizes key metrics and reported vulnerabilities. Last year, 320 reports were made to ASF concerning software vulnerabilities.

ASF reported that “Apache Software Foundation projects are highly diverse and independent. They have different languages, communities, management, and security models. However one of the things every project has in common is a consistent process for how reported security issues are handled. This report gave metrics for calendar year 2019 showing from the 18,000 emails received we triaged over 300 vulnerability reports leading to fixing just over 100 (CVE) issues.”

Digg This
Reddit This
Stumble Now!
Buzz This
Vote on DZone
Share on Facebook
Bookmark this on Delicious
Kick It on DotNetKicks.com
Shout it
Share on LinkedIn
Bookmark this on Technorati
Post on Twitter
Google Buzz (aka. Google Reader)
April 2nd, 2020
Category: Security
Leave a Comment

Leave a Reply

Your email address will not be published. Required fields are marked *

*

  • Legal Terms & Disclaimers

    This blog site is accessed from the website of Formtek, Inc. All visitors to or users of this blog site are subject to the terms and conditions and privacy policy that govern the Formtek website, links for which are provided above.

    Some of the individuals posting to this blog site, including the moderators, work for Formtek. Postings by these individuals are the personal opinions of these individuals, not of Formtek. Their posted content is provided for informational purposes only and is not meant to be an endorsement or representation by Formtek or any other party. Postings to this blog site may be outdated, invalid or inaccurate by the time you read them. Individuals posting to this blog site make no statements, representations or warranties as to the timing, validity, accuracy or reliability of their postings.

    This blog site may contain links to third party sites. Access to any third party site linked to this blog site is at your own risk. None of Formtek, the blog site moderator(s) and the individuals posting on this blog site that work for Formtek is responsible for the timing, validity, accuracy or reliability of any information, data, opinions, advice or statements made on these third party sites. These links are provided merely as a convenience and do not imply any endorsement.

    Postings to this blog site are available to the public. You should not post, link to or otherwise upload any information considered confidential to this blog site. All postings to this blog site are moderated. Postings will appear if and when they are approved by the moderator. Notwithstanding any approval by the moderator, by posting information to this blog site, you agree to be solely responsible for the information you post, link to, or otherwise upload to the blog site. You agree to release Formtek from any liability related to that information or to your use of the blog site. You grant Formtek a worldwide, perpetual, irrevocable, royalty-free, fully-paid, and transferable (including rights to sublicense) right to exercise all copyright, publicity, and moral rights with respect to any information you post, link to or otherwise upload to this blog site.

    • © Copyright 2003-2026   Formtek, Inc.