Here are several excerpts from an article by Asavin Wattanajantra, Survey Claims Open Source is a Business Security Risk:
The most widely-used open-source software packages are exposing businesses to significant and unnecessary risk, according to Fortify.
In its Open Source Security Study, which examined 11 of the most common Java open source packages, Fortify claimed that open-source software development communities were not working securely and leaving dangerous vulnerabilities unaddressed.
The packages tested included application server, customer relationship management (CRM), web application and content management system (CMS) projects. Most did not have documentation covering security, an email for users to report vulnerabilities, or easy access to internal experts to discuss security issues. Also, in every project analysed, there were security issues that werenâ€™t addressed.
The survey showed that most open source communities did not follow business-level control standards, and that there was a hidden cost for companies using open source as they had to test and patch for unanticipated security bugs.
Howard A. Schmidt, a former cyber security officer to the White House, said that open-source software was valuable, but needed to be a point of concern for chief information officers who depended on it to run their business.
Fortify recommended that government and commercial organisations which use open source do so with great caution, and that open source communities needed to raise security awareness as well as adopt commercial security practices from the commercial world.