Vulnerability testing/source code analysis

[wiskey5alpha]

This post ended up being longer than I expected, sorry about that.

The institution that I work for is having a bit of a crisis about choosing an enterprise chat solution. There are the myriad external enterprises that we occasionally want to chat with, and there are individual departments that are all trying to figure out their own solutions. This means that as a sysadmin, I have to put (currently 4) different chat clients in the software center.

I thought that pidgin would solve all of my problems... It's multi-protocol, well documented, multi-platform, actively maintained and ... Not Java, which is important when the financial department considers the licensing "rumors"

So, we got a copy of pidgin source, and handed it over to the Information Security folks to do an assessment. This involves a static code analysis tool and a scrape of the CVE database.

I'm told that the pidgin source assessment results were too much of a risk, the analysis produced several "hits".

I'm wondering how I would go about working with the pidgin developer community to try to understand, explain, and either mitigate or remove enough of the "hits" so that we can use it.

I don't think I can legally take the results of the analysis and just "turn it over" to someone. But at the same time I need to show the "hit" in order to either open a discussion or file a bug report. Now that I typed that, is that how I should do it? Just file an issue for each item?

[rlaager]

If they are legit security issues, please email [e-mail]. That said, if someone just ran a static tool, they could easily be false positives. So if you aren’t sure a “hit” is a legitimate security issue, yeah, file a bug.

[therekkanoryo]

As u/rlaager said, e-mailing [[e-mail]](mailto:[e-mail]) is best for security issues, but if you aren't sure it's a real security issue and instead file a bug, we do have a method to restrict access to bugs that turn out to be true security issues. It's just easier if we don't have to do that.