2019-06-19 09:31:16 +00:00
# Security Policy
2021-08-23 12:16:26 +00:00
## Security Announcements
2021-10-07 17:30:07 +00:00
Security fixes will be announced by posting them in the [security changelog ](https://clickhouse.com/docs/en/whats-new/security-changelog/ ).
2019-06-19 09:31:16 +00:00
2021-08-23 12:16:26 +00:00
## Scope and Supported Versions
The following versions of ClickHouse server are currently being supported with security updates:
2019-06-19 09:31:16 +00:00
| Version | Supported |
| ------- | ------------------ |
| 1.x | :x: |
| 18.x | :x: |
2020-03-15 13:53:24 +00:00
| 19.x | :x: |
2021-10-07 17:29:10 +00:00
| 20.x | :x: |
2021-08-23 13:08:08 +00:00
| 21.1 | :x: |
| 21.2 | :x: |
2022-03-17 21:35:03 +00:00
| 21.3 | :x: |
2021-08-23 13:08:08 +00:00
| 21.4 | :x: |
| 21.5 | :x: |
2021-09-21 13:23:04 +00:00
| 21.6 | :x: |
2021-11-24 21:59:52 +00:00
| 21.7 | :x: |
2021-08-23 13:08:08 +00:00
| 21.8 | ✅ |
2022-01-04 20:40:35 +00:00
| 21.9 | :x: |
2022-02-03 13:06:33 +00:00
| 21.10 | :x: |
2022-03-17 21:35:03 +00:00
| 21.11 | :x: |
| 21.12 | :x: |
2022-05-25 17:04:15 +00:00
| 22.1 | :x: |
| 22.2 | :x: |
2022-03-17 21:35:03 +00:00
| 22.3 | ✅ |
2022-05-25 17:04:15 +00:00
| 22.4 | ✅ |
| 22.5 | ✅ |
2019-06-19 09:31:16 +00:00
## Reporting a Vulnerability
2021-08-23 13:10:41 +00:00
We're extremely grateful for security researchers and users that report vulnerabilities to the ClickHouse Open Source Community. All reports are thoroughly investigated by developers.
2021-08-23 12:16:26 +00:00
2021-09-21 13:23:04 +00:00
To report a potential vulnerability in ClickHouse please send the details about it to [security@clickhouse.com ](mailto:security@clickhouse.com ).
2021-08-23 12:16:26 +00:00
### When Should I Report a Vulnerability?
2021-08-23 13:10:41 +00:00
- You think you discovered a potential security vulnerability in ClickHouse
- You are unsure how a vulnerability affects ClickHouse
2021-08-23 12:16:26 +00:00
### When Should I NOT Report a Vulnerability?
2021-08-23 13:10:41 +00:00
- You need help tuning ClickHouse components for security
2021-08-23 12:16:26 +00:00
- You need help applying security related updates
- Your issue is not security related
## Security Vulnerability Response
2021-08-23 13:10:41 +00:00
Each report is acknowledged and analyzed by ClickHouse maintainers within 5 working days.
2021-08-23 12:16:26 +00:00
As the security issue moves from triage, to identified fix, to release planning we will keep the reporter updated.
## Public Disclosure Timing
2021-08-23 13:10:41 +00:00
A public disclosure date is negotiated by the ClickHouse maintainers and the bug submitter. We prefer to fully disclose the bug as soon as possible once a user mitigation is available. It is reasonable to delay disclosure when the bug or the fix is not yet fully understood, the solution is not well-tested, or for vendor coordination. The timeframe for disclosure is from immediate (especially if it's already publicly known) to 90 days. For a vulnerability with a straightforward mitigation, we expect report date to disclosure date to be on the order of 7 days.
2021-08-23 12:16:26 +00:00
