On Apr 14, 2011, at 3:41 PM, Lynn Gayowski wrote:
Klocwork’s open source program did some source code analysis for
OpenLDAP a few years back. We’ve analyzed the project again using our static analysis
product, Klocwork Insight, and found some bugs and potential security vulnerabilities that
may be of interest. The results are hosted on a secure web portal so only contributors to
the project will have access to the results. They will not be published. Please email
opensource at klocwork dot com for the login credentials.
For the benefit of you and the community, please note that the OpenLDAP Foundation
considers this as an open request for those interested in the Klockwork report to contact
Klockwork for that report. To the extent that Klockwork and any interested party choose
to enter into any sort of agreement, that agreement is between Klockwork and the
interested party. The OpenLDAP Foundation, nor the OpenLDAP Project (an organized
activity of the OpenLDAP Foundation), would not be a party to that agreement and hence
cannot and will not be bound by any such agreement.
It must also be noted that the Project requires all contributions (including not just
source code) to be publicly disclosable. This is why it won't enter into an agreement
precluding it from publishing particular contributions, such as a report. It is the
contributors responsibility, not the Project's, to only contribute materials which are
publicly disclosable. The Project will publish any and all contributions (it may choose
to delay contributions of certain materials (such as "major security issues",
but all contributions get published in due course).
This note is not intended to dissuade anyone interested in this report from seeking access
to the report and/or viewing the report. The note is intended to make clear that those
seeking access to such reports are acting on their own behalf, not on the behalf of the
OpenLDAP Foundation or the OpenLDAP Project.
Executive Director, OpenLDAP Foundation
Full Details/Issue Management: http://goo.gl/9GNiu
This program will be offered free to open source projects on an ongoing basis, so if you
find the results of value we could analyze future versions of your project as well.
P +1.613. 836.8899 ext. 424
lynn.gayowski at klocwork.com