3 ms·

> and then the government within 2 days. That's wrong. According to the text Alibaba is not required to report the bug to government at all. The 2 days term ap

by rfoo 5y ago

> and then the government within 2 days. That's wrong. According to the text Alibaba is not required to report the bug to government at all. The 2 days term apply to "domestic network product provider" which would be ASF/log4j maintainers in this case. But they are not domestic so this does not apply.

oefrha 5y ago
Alibaba Cloud, like the other big clouds, has many Java-based products. They’re certainly the vendor of their own vulnerable Java-based products. Whether some other party wrote the code in question doesn’t change that.
- rfoo 5y ago
  Thanks, you're right that they certainly are the vendor of their own vulnerable Java-based products. AFAIK when the bug became popular on Dec 9, there are still many Java-based services running by Alibaba Cloud remain unfixed, and it caused chaos and panic among their "SRE"s. However reading the regulation text again, now I'm not sure in this case what Alibaba should report: > （二）应当在2日内向工业和信息化部网络安全威胁和漏洞信息共享平台报送相关漏洞信息。报送内容应当包括存在网络产品安全漏洞的产品名称、型号、版本以及漏洞的技术特点、危害和影响范围等。 It said they should report "the name, type and version of the product with the vulnerability, the 'technical characteristics' of the vulnerability and the impact". Does this mean, Alibaba should report, for example: "Alibaba Cloud hosted Apache Flink stream computing service (whatever brand name they use) contains a pre-auth critical RCE vulnerability due to insecure processing of user input in version a.b.c till x.y.z"? I'm not seeing how could the government know what the bug really is if "the product" means Alibaba Cloud's own product.
sudosysgen 5y ago
Thanks for the correction. I am not convinced however, if Alibaba ships a single product with Log4J it would be their own product too.
- rfoo 5y ago
  See my sibling comment, if "the product" != log4j, Alibaba is then not required to report that log4j had a vulnerability. Do you mean by redistributing log4j they became a "network product provider" of log4j?
  - sudosysgen 5y ago
    Either that, or that one of their own products is vulnerable because of the Log4J vulnerability.
    - deleted 5y ago
      [deleted]

by rfoo 5y ago

oefrha 5y ago

Alibaba Cloud, like the other big clouds, has many Java-based products. They’re certainly the vendor of their own vulnerable Java-based products. Whether some other party wrote the code in question doesn’t change that.

rfoo 5y ago
Thanks, you're right that they certainly are the vendor of their own vulnerable Java-based products. AFAIK when the bug became popular on Dec 9, there are still many Java-based services running by Alibaba Cloud remain unfixed, and it caused chaos and panic among their "SRE"s. However reading the regulation text again, now I'm not sure in this case what Alibaba should report: > （二）应当在2日内向工业和信息化部网络安全威胁和漏洞信息共享平台报送相关漏洞信息。报送内容应当包括存在网络产品安全漏洞的产品名称、型号、版本以及漏洞的技术特点、危害和影响范围等。 It said they should report "the name, type and version of the product with the vulnerability, the 'technical characteristics' of the vulnerability and the impact". Does this mean, Alibaba should report, for example: "Alibaba Cloud hosted Apache Flink stream computing service (whatever brand name they use) contains a pre-auth critical RCE vulnerability due to insecure processing of user input in version a.b.c till x.y.z"? I'm not seeing how could the government know what the bug really is if "the product" means Alibaba Cloud's own product.

sudosysgen 5y ago

Thanks for the correction. I am not convinced however, if Alibaba ships a single product with Log4J it would be their own product too.

rfoo 5y ago
See my sibling comment, if "the product" != log4j, Alibaba is then not required to report that log4j had a vulnerability. Do you mean by redistributing log4j they became a "network product provider" of log4j?
- sudosysgen 5y ago
  Either that, or that one of their own products is vulnerable because of the Log4J vulnerability.
  - deleted 5y ago
    [deleted]