RAROME is committed to resolving security susceptibilities quickly and carefully. Such resolutions may lead to the release of a Security Advisory and/or any needed product update for our customers. In order to protect our customers and their data, we request that susceptibilities be responsibly and confidentially reported to us so that we may investigate and respond. susceptibilities should not be announced until we have developed and comprehensively tested a product update and made it available to licensed customers.

RAROME’s products are complex. They run on diverse hardware and software configurations and are connected to many third-party applications. All software modifications – big or small — require thorough analysis, as well as development and implementation across multiple product lines and versions. The software must also undergo localization, accessibility, and be testing appropriate to its scope, complexity, and severity. Given the critical importance of our products to our customers, RAROME must ensure that they run correctly not only in our testing facilities but also in customer environments. Accordingly, RAROME cannot provide product updates according to a set timeline — but we are committed to working expeditiously.

Malicious parties often exploit software susceptibilities by reverse engineering published security advisories and product updates. It is important for customers to update software promptly and use our severity rating system as a guide to better schedule upgrades. Therefore, public discussion of the susceptibility is only appropriate after customers have an opportunity to obtain product updates.