As a widely adopted distributed storage service, TiKV attaches great importance to code security. We are very grateful to users, security vulnerability researchers, etc. for reporting security vulnerabilities to us. All reported security vulnerabilities will be carefully assessed, addressed, and answered by us.
This document describes the security process and policy followed by the TiKV project.
Security vulnerabilities should be handled quickly and sometimes privately. The primary goal of this process is to reduce the total time users are vulnerable to publicly known exploits.
The TiKV Security Team is responsible for organizing the entire response including internal communication and external disclosure but will need help from relevant developers to successfully run this process.
The TiKV Security Team will consist of TiKV contributors assigned by the TiKV Maintainer team.
The following are the versions that we support for security updates
Version | Supported |
---|---|
6.x | ✅ |
5.x | ✅ |
4.x | ✅ |
3.x | ✅ |
2.x | ✅ |
< 2.0 | ❌ |
For all TiKV security-related defects, please send an email to [email protected]. This mailing list is specially maintained by the TiKV security team. You will receive an acknowledgement mail within 24 hours. After that, we will give a detailed response about the subsequent process within 48 hours. Please do not submit security vulnerabilities directly as Github Issues.
If you want to, you can choose to use the PGP public key provided by us to encrypt the content of the mail. The public key is provided at the end of this document.
For known public security vulnerabilities, we will disclose the disclosure as soon as possible after receiving the report. Vulnerabilities discovered for the first time will be disclosed in accordance with the following process:
- The received security vulnerability report shall be handed over to the security team for follow-up coordination and repair work.
- After the vulnerability is confirmed, we will create a draft Security Advisory on Github that lists the details of the vulnerability.
- Invite related personnel to discuss about the fix.
- Fork the temporary private repository on Github, and collaborate to fix the vulnerability.
- After the fix code is merged into all supported versions, the vulnerability will be publicly posted in the GitHub Advisory Database.
-----BEGIN PGP PUBLIC KEY BLOCK-----
mQINBF65AgsBEADGYwoBKPUhCZgz24AGnJtOB/LgCRuqZupJHY/RmYdchKWIGHIv
buIP6890L2OlzyxItNWbZmGM6fgcqFpPKWX1budsDI01hafoPyIM/fpuWUCip5Pm
rXEaGXXmouVVeAS2fSkHXT2ZLCN4bzPvIwoc28a99QPRG ldNYzsle7oNus12s C
l7ZhNXsmyILc9c6cxkUN hKx4jDeLBh1FbK5pbYWLWxfwmfz7wsogRRuDovtJmtX
JgHR/LZwU7RpHEPsU/IHeLhoC406sCTvAcUSH0M7LF2O4x9Crf/niGETjRAxH3nW
bYjJYcziL1IrvWsHhA11AGLkwpmCMilY1gHHnbbkslv5Gzx6nLQ/rA1Q2/R5KfKV
PwsrDavGtAgE3SAXw9WiBOpZK zkKVdGHlit/G7qX1Y54Ez/UyYbqVsTH97cberU
chhu6eeI7ewV4Jp7yxaKK0QWEZufxioN5uoGCdyEGSvA3hkSNIpmPvKZN2/6ZqHb
87rT6zluTlMWuP7yVkhxF7BSanjNDvsiX ZNjJiB/j4d3W8DXa8HH0EF5036QrDb
ofEELY9MDBlWzBTEtdJ d5G6Ol3xOe0dUpWJagzyVH4gmHh9ybYiNhvaliF48gnt
pCDWZXn3HKUgSF09OjxuuUMzM5f1GA6QoplpSPTvM3C7sFV67sfRW4lXbwARAQAB
tDBUaUtWIFNlY3VyaXR5IFRlYW0gPHRpa3Ytc2VjdXJpdHlAbGlzdHMuY25jZi5p
bz6JAlQEEwEIAD4WIQTgOW4PEUEI8cZyOUfKixh14wzMzAUCXrkCCwIbAwUJA8Jn
AAULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRDKixh14wzMzCfSD/91m/zL/dVm
NK2hQ8XUKHYECGWSCIwX2V7CLuqrj5oUlP3BWZvFoKdW0gcr0youywDPSwNLbx9
Mk56hWpYLaMyM1 bFS80eP Ro0VWZ68FujPYzdkbVDxlF GVGm7znwPcFRNBfuNe
Ey8f6cOFOMb/FgWxOV2UzLuO5xywI18Lbzk/s9cA32KIu5aLd8Pi0nLQss XE4PT
9vPiZ1 4LHW5wzUIsX0mtxQRO0wcvdM2Tl/rsVSKIGFjU riv5/sdWCiZ1ymdamp
abu26S8XCFcwdcElchhPPGef0YnNmd O5UQ3gVnpxtlmrKvCzeEw8SCvRRaaLa
ulH0aDH6BLYYXOy5hc3OAySL5xZk77k4oOREXwGtgu8kbzBpJYEvls cuezDEohG
f1oAmGdj0ntJZqrOXuOOtVFnOMTn8NxnFZ0Zz4f2MJpGQX8mx3wS26FbPnPlC8MA
fqSQ5eo6sz/51fiEkwrvjwTvA98LhhqMkNq5 jatfko7Pe8QfXOERcfTXxlJSK3u
Mrr48ZCzvf4o1Cwnyv1TvCIZQBY0DrM0GHh7J5tXuLjD38O9m UjxhHh7tyQZcyh
tXsiIOZwmme2EDuJ3kvB08Qr4vRrIKfOa1N4n2 qR1imN0l9YcrYY5ib1nyYAZRX
TcMEt1CESrcNBlcaL nkFXwOaC4hqB3Ha7kCDQReuQILARAAwgzslCYn3kL01EBH
V6CQKc21nhSM0Qv ehRJnZL9t5Ke074aevG3/4a5P07ze5cqKs/jSa/0wV PP/yG
19TZrg6VtJ949ly3Hh CHpVGBzhhX10cJs58b3/Q95LX4jBNJQcYbgSPDRw5KFkq
oIPJzD4wvBadrK7N7ZW19cLIoA8v6H8fvKiJCFfuD1ijh5W4F5pMyWxgcIEroppg
7uLaz1GX0GDDFKXxNk5jd8iFgRpCUZYuvryGO8wWxGpLIB3BWb/dNEQeCKYno4Ng
NdTA/tWBR5sQEYitkNQhAl4K1BRj52nwNVXdZWDxMtKhpxwUtzpUnb57fRm wMWH
FvEEgtyfNVWkrt4/U6pyTmn1Ic4IHh3H3HhA5rhnqLQLW 9Brmv TsOUdxRueQIw
KLcdjKPYfpU4BKhzbSnYs3JgFEJapXByZEsA5aFfpfANBJj8NoKiHM91R0g86Iv
I nyAgOHE 6 sdHT7f5XKkt3gTPmIjpP3Li3NUTPDrzMcdfMxxbe937Ej9v1cSNY
3 VWWTKFqAa/MRPbcWaPx7sZQhERkyzuUBle1 7bdswXNApbczjnnxV2gvRMQq1
VJC9TGjTOQwF/ex lkZiffjaVSeGdjsDBOUKyx7oQvSoSi6OuIJGswoN68wk0PO3
lw/vAtSomcLVIl4bhpd1gUUoZ3sAEQEAAYkCPAQYAQgAJhYhBOA5bg8RQQjxxnI5
R8qLGHXjDMzMBQJeuQILAhsMBQkDwmcAAAoJEMqLGHXjDMzMsgAQAInDBThgzaEl
zBJ8jLxVECw3V8LLKEaOp4Yl8G6caIzLJQ 8pFgWBmtua8IM3MsvfM6u5ET0cXqa
HXQcX91kCKS GWIrTeC8zliOTeksrpz0orzMzAhxx5qK4WtgbcpU8FuvSF v7JCm
U/YX8aGZJufrxeTgR4OmOoZUNtXO1YljVpLpxi0U0a2BMztSRATd9JQchEp5pGT/
Cvsf/45LtqEYY/NOHCZVqmZmF8RqTdwrcH5f1EP31J F9IoVgonw 4VAUCqBiQQk
2MGR4XBASTYbJ8v8b8gzf2R0HZgvrDXxz1nwEaikmU7W 0r2RDGQy etfJsarwkS
qwmc1AiznSTiuu1x9iV44tnCcmdFo3YFcd8kRHr1aIy1kdaXCL Lns5HLmKKfOjQ
j9bAH01FuSSlPLoaTWoqf Sm3Fu/KeW0mQHulDXujV1lYX0jUxy7lmj2P/yR8ZdD
12o9srqrh4Rja72g5utmA7ZTuSq4YwsXvQ13c3agZKO WuiQkRfsgkh/NIWTyCXn
IvCICV7zG1cyuM/Z2Y7/TJ upvahP46nM3s3G15b8FYuTSmRN1Kp9 mBt2BHqOy1
5MKKdj J5co/zuRpgsuIIgTDrkS0UjN57BsHbIXhTQmQeablbIaMUtIxCH8t0V3K
ulx VF4Lf9n3ydf593Nha9bMJ/rnSp01
=XbYK
-----END PGP PUBLIC KEY BLOCK-----