From 49b1f62abd91af876190b4ebb4b343500f541105 Mon Sep 17 00:00:00 2001 From: "Mikhail f. Shiryaev" Date: Wed, 3 Aug 2022 12:06:45 +0200 Subject: [PATCH] Update SECURITY.md --- SECURITY.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 81d2fd18fb2..4bb6d9d0b3b 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -10,9 +10,10 @@ The following versions of ClickHouse server are currently being supported with s | Version | Supported | |:-|:-| +| 22.7 | ✔️ | | 22.6 | ✔️ | | 22.5 | ✔️ | -| 22.4 | ✔️ | +| 22.4 | ❌ | | 22.3 | ✔️ | | 22.2 | ❌ | | 22.1 | ❌ | @@ -57,5 +58,5 @@ As the security issue moves from triage, to identified fix, to release planning ## Public Disclosure Timing -A public disclosure date is negotiated by the ClickHouse maintainers and the bug submitter. We prefer to fully disclose the bug as soon as possible once a user mitigation is available. It is reasonable to delay disclosure when the bug or the fix is not yet fully understood, the solution is not well-tested, or for vendor coordination. The timeframe for disclosure is from immediate (especially if it's already publicly known) to 90 days. For a vulnerability with a straightforward mitigation, we expect report date to disclosure date to be on the order of 7 days. +A public disclosure date is negotiated by the ClickHouse maintainers and the bug submitter. We prefer to fully disclose the bug as soon as possible once a user mitigation is available. It is reasonable to delay disclosure when the bug or the fix is not yet fully understood, the solution is not well-tested, or for vendor coordination. The timeframe for disclosure is from immediate (especially if it's already publicly known) to 90 days. For a vulnerability with a straightforward mitigation, we expect the report date to disclosure date to be on the order of 7 days.