Vulnerability Fixing Policies

Vulnerability Fixing Time

• High-risk vulnerabilities

  After the Redis community detects vulnerabilities and releases fixing solutions, Distributed Cache Service (DCS) fixes the vulnerabilities according the community's policies and fully verifies the Redis kernel changes within one to three months.

• Other vulnerabilities

  See Release History. Fix them through a normal upgrade.

Fixing Statement

To prevent customers from being exposed to unexpected risks, DCS does not provide other information about the vulnerability except the vulnerability background, details, technical analysis, affected functions/versions/scenarios, solutions, and reference information.

In addition, DCS provides the same information for all customers to protect all customers equally. DCS will not notify individual customers in advance.

DCS does not develop or release intrusive code (or code for verification) to exploit vulnerabilities.