Security Advisories & Cumulative Security Patch Release

Overview

Security advisories are released when critical vulnerabilities are found in Paradine’s software products.

Vulnerabilities are rated according to the Common Vulnerability Scoring System (CVSS) which captures the principal technical characteristics of software, hardware and firmware vulnerabilities. Its outputs include numerical scores indicating the severity of a vulnerability relative to other vulnerabilities.

In case critical security vulnerability is detected in our software products, we are submitting a security advisory describing the issue and mitigation possibilities on this page.

Quarterly we are providing a Cumulative Security Release for releases under active maintenance.

Impact to customer installations

In our managed service or cloud products, the identified critical vulnerabilities are patched by Paradine as soon as possible after detection.

For on-premise installations or customer maintained cloud installations, we are disclosing critical vulnerabilities on this page, so that appropriate patching measures can be taken by our customers.

Vulnerability fixing policy

Critical Security Vulnerabilities

When a Critical Security Vulnerability (9.0-10.0 according to CVSS v3.1 specification) is discovered by internal checks or reported by a third party, we will:

• Submit a security bulletin describing the issue and mitigation possibilities, usually in parallel with the release of potential patch release.

• If mitigation is acceptably possible the vulnerability security level will be changed to High, and the issue will be treated as non-critical vulnerability.

• If mitigation is not acceptably possible, we will issue a new, patch release for the latest software release,  fixing the issue in the affected product(s) as soon as possible.

• On demand of customer, we will prepare a new patch release also for a previous software release or components of the previous software release, if the release in focus is still under a valid maintenance contract.

In some cases, we may use additional information unrelated to CVSS score, e.g. knowledge about use of impacted components, to modify the severity level of a vulnerability.

Non-critical vulnerabilities (High, Medium, Low)

•  When a security issue of a High, Medium or Low severity is discovered, we will fix within the service level objectives for issues of problem class 3 which will be fixed together with the next minor or major release whatever comes earlier.

What is a false positive vulnerability assessment?

• An alert that incorrectly indicates that a vulnerability is present. Sources: NIST SP 800-115

• False positive vulnerabilities are documented but cannot be fixed.

List of Security Advisories & Cumulative Security Patch Release

Further reading

• CVSS Specification Document