Controversies

Log4j2 Vulnerability Not Reported in Time; MIIT Suspends Partner Qualification for 6 Months

In November 2021, Alibaba Cloud's security team discovered a severe security vulnerability (Log4Shell) in the Apache Log4j2 component and reported it to Apache officials, but did not promptly report it to China's telecommunications authorities. The Cybersecurity Administration of the Ministry of Industry and Information Technology therefore suspended Alibaba Cloud's qualification as a cooperating unit of the “Cybersecurity Threat Information Sharing Platform” for six months, and said it would consider restoring it after the period expired based on rectification. Alibaba Cloud responded that it would strengthen vulnerability management and enhance compliance awareness; the incident occurred shortly after the “Regulations on the Management of Security Vulnerabilities in Network Products” took effect and was seen as a landmark enforcement case for the vulnerability reporting system.