Static Code Analysis (SAST) of Open Source Software
On behalf of the German Federal Office for Information Security (BSI), we examined the source code of the open source applications Mastodon and Matrix for their security using static code analysis. In Mastodon, two vulnerabilities with increased hazard potential and several other security-relevant problems were discovered, which were immediately reported to the developers and mostly fixed. Some, albeit less serious, security problems were also identified in Matrix. The project aims to improve the security of popular open source software, especially for applications used by authorities or private users. The initiative will be continued with other open source applications.
The analysis was carried out in autumn 2023 and published on August 30, 2024.
