2022-05-17 11:09:34 +08:00
|
|
|
# Reporting security vulnerabilities
|
2020-09-09 07:12:56 +08:00
|
|
|
|
2022-05-17 11:09:34 +08:00
|
|
|
Oracle values the independent security research community and believes that
|
|
|
|
|
responsible disclosure of security vulnerabilities helps us ensure the security
|
|
|
|
|
and privacy of all our users.
|
2020-09-09 07:12:56 +08:00
|
|
|
|
2022-05-17 11:09:34 +08:00
|
|
|
Please do NOT raise a GitHub Issue to report a security vulnerability. If you
|
|
|
|
|
believe you have found a security vulnerability, please submit a report to
|
|
|
|
|
[secalert_us@oracle.com][1] preferably with a proof of concept. Please review
|
|
|
|
|
some additional information on [how to report security vulnerabilities to Oracle][2].
|
|
|
|
|
We encourage people who contact Oracle Security to use email encryption using
|
|
|
|
|
[our encryption key][3].
|
2020-11-29 06:40:07 +08:00
|
|
|
|
2022-05-17 11:09:34 +08:00
|
|
|
We ask that you do not use other channels or contact the project maintainers
|
|
|
|
|
directly.
|
2020-11-29 06:40:07 +08:00
|
|
|
|
2022-05-17 11:09:34 +08:00
|
|
|
Non-vulnerability related security issues including ideas for new or improved
|
|
|
|
|
security features are welcome on GitHub Issues.
|
2020-11-29 06:40:07 +08:00
|
|
|
|
2022-05-17 11:09:34 +08:00
|
|
|
## Security updates, alerts and bulletins
|
2020-11-29 06:40:07 +08:00
|
|
|
|
2022-05-17 11:09:34 +08:00
|
|
|
Security updates will be released on a regular cadence. Many of our projects
|
|
|
|
|
will typically release security fixes in conjunction with the
|
2023-06-27 21:21:33 +08:00
|
|
|
Oracle Critical Patch Update program. Additional
|
2022-05-17 11:09:34 +08:00
|
|
|
information, including past advisories, is available on our [security alerts][4]
|
|
|
|
|
page.
|
|
|
|
|
|
|
|
|
|
## Security-related information
|
|
|
|
|
|
|
|
|
|
We will provide security related information such as a threat model, considerations
|
|
|
|
|
for secure use, or any known security issues in our documentation. Please note
|
|
|
|
|
that labs and sample code are intended to demonstrate a concept and may not be
|
|
|
|
|
sufficiently hardened for production use.
|
|
|
|
|
|
|
|
|
|
[1]: mailto:secalert_us@oracle.com
|
|
|
|
|
[2]: https://www.oracle.com/corporate/security-practices/assurance/vulnerability/reporting.html
|
|
|
|
|
[3]: https://www.oracle.com/security-alerts/encryptionkey.html
|
|
|
|
|
[4]: https://www.oracle.com/security-alerts/
|
