SUSE Security Contacts - Support

Organization Security (Information for Independent Researchers)

In SUSE, we are committed to address any weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source. If you believe you have found any security problems in or related to our system, such as:

Vulnerability on our perimeter
Data leakage
Cases where SUSE was potentially compromised (phishing attacks, DDoS attacks, etc.)
Non-compliance with laws or other applicable regulations governing data and information protection,
please, contact us.

How to report to us

To report organization security vulnerability, please use following email:

cybersecurity@suse.com

Acknowledgement / What to expect

If you will report the relevant security issue and by this will help us to became more secure organization; we will be happy to provide you our public acknowledgment. However, please note that SUSE will not provide financial or any other material rewards for any reported issues.

We will take into consideration all reported issues, however we will not proceed further and will not provide the acknowledgment for the issues:

that were already reported by someone else,
theoretical issues with no proof of exploitability.

We hereby reserve the right to address the reported vulnerability within 30 days after becoming aware of it. This period can be extended to 60 days, if required by the specific nature of the vulnerability. After this period, independent researchers are allowed to make the respective vulnerability public, if not informed otherwise by us.

Product Security (Information for Independent Researchers)

SUSE is committed to delivering best effort security to its customers and to the Open Source community. We believe that trust in Open Source Software security in general, and the user's privacy in particular, are both indispensable and indefeasible.

Software security is a complex challenge. Software can provide many of its own security features, such as authentication methods, encryption, intrusion prevention and detection, and backup.

At the same time, it can also contain errors (both deliberate and accidental) that can affect the system's security, including design flaws, programming errors, and backdoors.

Please report to us if you believe that you have found a security issue.

How to report to us

To report product security vulnerability, please use following, email(s):

Acknowledgement / What to expect

If you will report the relevant security issue and by this will help us to develop more secure products; we will be happy to provide you our public acknowledgment. However, please note that SUSE will not provide financial or any other material rewards for any reported issues.

Organization and Product Security – Mail Encryption

We encourage people who wish to contact SUSE Security to use mail encryption. Please be aware that GPG encryption does not cover the email subject or the names of any attached files, so please don't store any confidential information on them. Our key is:

pub rsa4096/0xB205E69BAB2FD922 2020-03-10 [SC] [expires: 2026-01-25]
Key fingerprint = 2BAB 445F B9B4 F0D3 30E4 7CB0 B205 E69B AB2F D922
uid [ full ] SUSE Security Team security@suse.com
uid [ full ] SUSE Security Team security@suse.de
sub rsa4096/0xA679ED66FD417627 2020-03-10 [E] [expires: 2026-01-25]

The key is listed below in ASCII encoded form.

The previous key in use was:

pub rsa4096/0xB205E69BAB2FD922 2020-03-10 [SC] [expires: 2024-02-24]
Key fingerprint = 2BAB 445F B9B4 F0D3 30E4 7CB0 B205 E69B AB2F D922
uid [ full ] SUSE Security Team security@suse.com
uid [ full ] SUSE Security Team security@suse.de
sub rsa4096/0xA679ED66FD417627 2020-03-10 [E] [expires: 2024-02-24]

The key is listed below in ASCII encoded form.