Security Bulletins

Overview

The OPC Foundation publishes security bulletins that affect software that it maintains or distributes. In many cases these bulletins will affect code that OPC vendors incorporate into their products. As a result, vendors will have to patch their products to address the vulnerabilities identified.

Any vulnerabilities or security concerns should be reported to ‘securityteam AT opcfoundation DOT org’.
A PGP key to encrypt any sensitive security report can be found here.

Process

When an issue is reported, the OPC Foundation uses the Common Vulnerability Scoring System to rate vulnerability and requests a CVE number from MITRE. Vendors are encouraged to use the CVE number when they publish updates to their products so users can associate a product patch with a vulnerability reported by the OPC Foundation.

When vulnerabilities are reported they are first reviewed by the OPC UA Security WG to determine the best course of action. A notice is sent out to a SDK vendor mailing list that an issue has been reported that may require action on their part. SDK vendors receive advance notice because many OPC products are built with SDKs and addressing a vulnerability requires that the SDKs be updated first. Any OPC Foundation member that wishes to be informed before vulnerabilities are made public should send a request to join the UA Security WG.

After review, the Security WG will set a time line for making the vulnerability public. The time line will depend on the severity of the vulnerability and the time needed by SDK vendors to produce a patch for their products. When a vulnerability is made pubic it will appear on this page with details on where to find updated software. Any member of the public who wishes to receive notifications when new Security Bulletins are released to the public should join the OPC Security Bulletins Google Group.

When a vulnerability is made public, the OPC Foundation will notify MITRE.which means it will be made visible in their database. NIST will also automatically add the CVE to their database.