KaiwuDB PSIRT

Receipt Channels

• -Dedicated security email: security@kaiwudb.org.cn
• -Public vulnerability database monitoring (CVE/CNVD/CNNVD/NVD).
• -Internal security testing and code audit findings.
• -Reports from third-party security organizations.

Receipt Handling Steps

• -Registration and Filing: Within 24 hours of receiving a vulnerability report, assign a unique vulnerability tracking number and record the source, date, product version, vulnerability description, and other information.
• -Acknowledgment: Send a confirmation receipt to the reporter, informing them that the vulnerability has been accepted and outlining the subsequent process, while establishing a communication channel.
• -Information Supplementation: If the report lacks sufficient information (e.g., reproduction steps, POC), proactively communicate with the reporter to obtain additional details.
• -Initial Triage: Filter out non-security issues, duplicate vulnerabilities, user configuration errors, and other reports that do not constitute product security vulnerabilities.

Analysis Contents

• -Vulnerability Verification: Reproduce the vulnerability in a test environment to confirm its existence.
• -Root Cause Analysis: Identify the underlying cause of the vulnerability (code defect, design flaw, configuration issue, etc.).
• -Impact Scope Assessment: Determine affected product versions, components, and deployment modes.
• -Severity Scoring: Apply CVSS scoring standards.
• -Exploitability Assessment: Evaluate the technical barriers and prerequisites for exploiting the vulnerability.
• -Business Impact Analysis: Assess the actual impact on customer business if the vulnerability is exploited.

Remediation Strategies

• -Develop Remediation Plan: The core R&D team formulates a code fix plan, and PSIRT reviews the plan for security and completeness.
• -Emergency Mitigation Measures: For high-severity vulnerabilities, provide temporary mitigation measures (e.g., configuration changes, access control policies, feature disabling) before the official patch is released.
• -Patch Development: The R&D team implements code modifications according to the remediation plan, following secure coding practices.
• -Multi-version Adaptation: Develop patches separately for all affected supported versions.
• -Remediation Self-Check: After development, perform unit testing and vulnerability reproduction verification.

Disclosure Principles

• -Responsible Disclosure: Disclose vulnerability details only after a patch or mitigation measures are available.
• -Tiered Disclosure: High-severity vulnerabilities are prioritized for notification to contracted customers; general vulnerabilities are disclosed via unified security advisories.
• -Sufficient Information: Advisories include vulnerability description, affected versions, risk assessment, remediation measures, and mitigation options.
• -Vulnerability Sources: Vulnerabilities submitted via email or collected from public information.

Disclosure Channels

• -Customer Priority Notification: For contracted customers, provide advance notice (48 hours) through technical support channels before public advisory release.
• -Official Security Advisory: Publish formal security announcements on the official Security Advisory page.

Tracking Contents

• -Patch Deployment Monitoring: Track customer patch upgrade progress and identify high-risk customers who have not applied patches in a timely manner.
• -Issue Feedback Collection: Collect issues encountered by customers during patch application.
• -Vulnerability Exploit Monitoring: Monitor public channels for exploit code or in-the-wild exploitation intelligence.
• -Patch Updates: If patch defects are found, release revised patches promptly.
• -Root Cause Review: After high-severity vulnerability remediation is completed, organize a review meeting to analyze the root cause and formulate preventive measures.
• -Process Improvement: Translate review conclusions into secure coding standards, test cases, and automated detection rules.