Feranor

Software & Consulting

Feranor PQC Suite security advisories

When a vulnerability of Feranor PQC Suite is fixed, we publish an advisory here, with the affected versions, the impact, the severity and how to remediate. Customers receive it first, by e-mail, with the mitigations available before they update.

Security fixes are free of charge for every user of a supported version, for 5 years after the first release of each major version from 1.0. Before 1.0, the latest release is the one maintained, and moving to 1.0 is free of charge.

Advisories

No advisory has been published to date.

Reporting a vulnerability

Write to security@feranor.com, encrypted if you wish with our OpenPGP key, rather than through support or any public channel. Give the product and its version, the impact as you understand it, and what reproduces it.

We agree on a disclosure date with you, and credit you in the advisory unless you prefer otherwise. Our security.txt gives the same contacts.

What happens next

  • 2 business days to acknowledge your report
  • 5 business days for a first assessment, confirmed or not, with its CVSS severity
  • 30 days to fix a critical or high severity vulnerability
  • 90 days at most for a medium or low one, in the next release

A CVE identifier is requested when released versions are affected. Every release carries CycloneDX software bills of materials, to check its components against published vulnerabilities.

Cyber Resilience Act

Feranor handles the vulnerabilities of its product as the Cyber Resilience Act requires of manufacturers (Regulation (EU) 2024/2847). An actively exploited vulnerability, or a severe incident affecting the security of the product, is notified through ENISA's single reporting platform to CERT-FR and to ENISA, with an early warning within 24 hours, a notification within 72 hours, then a final report. Users are then informed of the measures they can take, in the machine-readable format below.

Machine-readable advisories

Each advisory is also published as a CSAF 2.0 document (OASIS Common Security Advisory Framework), which your tools can fetch and match against your inventory. Feranor is a CSAF provider. Its provider metadata names the distribution, whose index.txt and changes.csv list every document, each with its SHA-256 and SHA-512.

The security.txt of the site points to the provider metadata, so that aggregators find it on their own.