留言板

Addressing security vulnerabilities in CE

Kyriacos Neocleous,修改在12 年前。

Addressing security vulnerabilities in CE

New Member 帖子: 8 加入日期: 11-9-26 最近的帖子
Hi, I'm using the community edition. Sometimes I get emails for the release of security vulnerability patches targeted for enterprise edition. Don't know how I got myself subscribed in that mailing list, I think I made an inquiry for the price of EE. In any case, does anyone know how this works for the CE? Do we get the same patch with some delay, or don't get a patch until the next major release?

Best Regards
Kyriacos
thumbnail
Mika Koivisto,修改在12 年前。

RE: Addressing security vulnerabilities in CE

Liferay Legend 帖子: 1519 加入日期: 06-8-7 最近的帖子
Some critical patches are release to CE as patches for others it's included in the next CE release.
Kyriacos Neocleous,修改在12 年前。

RE: Addressing security vulnerabilities in CE

New Member 帖子: 8 加入日期: 11-9-26 最近的帖子
Hi Mika, thanks for your quick response! Can you please give me a documentation/wiki URL that discusses what is considered critical and what not for releasing immediately to CE?
thumbnail
Mika Koivisto,修改在12 年前。

RE: Addressing security vulnerabilities in CE

Liferay Legend 帖子: 1519 加入日期: 06-8-7 最近的帖子
They are deemed so on case by case at Liferay's discretion.
thumbnail
Hitoshi Ozawa,修改在12 年前。

RE: Addressing security vulnerabilities in CE

Liferay Legend 帖子: 7942 加入日期: 10-3-24 最近的帖子
There's a simple guideline in Liferay's Jira wiki when creating an issue. Liferay may change the priority when processing an issue so this may not be 100% correct but may give you some guidelines.

http://www.liferay.com/community/wiki/-/wiki/Main/JIRA

Priority/Severity #
An issue has a severity level which indicates its importance. The currently defined severities are listed below.

•Critical - Crashes, loss of data, severe memory leak, security hole, no valid workaround.
•Major - Major loss of function.
•Minor - Minor loss of function, edge case not experienced by most users, or other problem where easy workaround is present.
•Trivial - Cosmetic problem like incorrect spelling or misaligned text.
Some examples:

•Causes data loss (e.g. account data) or data corruption on upgrade with no good workaround - Critical
•Causes Liferay to freeze after a particular operation with no good workaround - Critical
•Allows unauthenticated users to see protected content - Critical
•Crashes Liferay, workaround provided - Major
•Adding 10 document library portlets to a page causes javascript error - Minor
•Missing translation for phrase - Trivial