Thanks, you're right that they certainly are the vendor of their own vulnerable Java-based products. AFAIK when the bug became popular on Dec 9, there are stil

Thanks, you're right that they certainly are the vendor of their own vulnerable Java-based products. AFAIK when the bug became popular on Dec 9, there are still many Java-based services running by Alibaba Cloud remain unfixed, and it caused chaos and panic among their "SRE"s. However reading the regulation text again, now I'm not sure in this case what Alibaba should report: > （二）应当在2日内向工业和信息化部网络安全威胁和漏洞信息共享平台报送相关漏洞信息。报送内容应当包括存在网络产品安全漏洞的产品名称、型号、版本以及漏洞的技术特点、危害和影响范围等。 It said they should report "the name, type and version of the product with the vulnerability, the 'technical characteristics' of the vulnerability and the impact". Does this mean, Alibaba should report, for example: "Alibaba Cloud hosted Apache Flink stream computing service (whatever brand name they use) contains a pre-auth critical RCE vulnerability due to insecure processing of user input in version a.b.c till x.y.z"? I'm not seeing how could the government know what the bug really is if "the product" means Alibaba Cloud's own product.