Vulnerability Disclosure
Our Vulnerability Disclosure Policy outlines how we handle reports of vulnerabilities in our software or hardware systems, and provide clear guidance to those who discover weaknesses.
Vulnerability Disclosure Policy
Canon Production Printing (“we”, “our” or “us”) will collect and disclose product vulnerability information to ensure the security of our products and services (“Products”) and to protect our customers from cyber threats.
PSIRT Establishment
We have a Product Security Incident Response Team (PSIRT) to handle vulnerability information relevant to the Canon Production Printing Products reported and managed through the Canon EMEA PSIRT.
Vulnerability Management
We work continuously to identify and limit the risk associated with vulnerabilities in our Products. However, suppose you identify a product vulnerability as an end-user, partner, vendor, industry group, or independent researcher. In such as case, we encourage you to report the problem immediately via the Canon EMEA PSIRT using the reporting form link below. Timely reporting of vulnerabilities is critical to reducing the likelihood that they can be exploited in practice. Report a product security issue.
Report a product security issue
We will work closely with the Canon EMEA PSIRT to ensure an agreed disclosure process and date. You can find further details in the Canon EMEA PSIRT Vulnerability Disclosure Policy.
Bug Bounty Program
We do not conduct a bug bounty program. Accordingly, please acknowledge that there is no expectation of payment or compensation and that any future right to claim related to the submitted report is waived.
How We Handle Vulnerability Information
Reported vulnerability information for the relevant Products will be evaluated by our technical teams, after which we will provide feedback to the reporter via the Canon EMEA PSIRT. Canon Production Printing may publish product security, advisories, and notifications on its Security News webpage.
Measures to Vulnerabilities
If we determine that the submitted report describes a new vulnerability, we will implement countermeasures and/or present workarounds that we determine appropriate. In addition, when deemed necessary, we will publish security advisories on our Canon Production Printing product security advisories and notifications webpage as soon as we can disclose information to enable our customers/partners to take appropriate mitigating measures. A security advisory is typically provided only for Canon Production Printing-specific vulnerabilities.
Use of Reported Vulnerabilities
We appreciate you, being the reporter, reporting to us vulnerability information, including any data, text, material, program code, suggestion, and recommendation (collectively “Reported Vulnerabilities”) to enable us to investigate and if necessary, providing solutions to prevent any risks and vulnerabilities in our Products. By providing any Reported Vulnerabilities to us, you understand and agree that:
- We are entitled and may freely use Reported Vulnerabilities for the following: (i) to use, review and assess the Reported Vulnerabilities and to test and analyze our involved Product(s); and (ii) to reproduce, modify, distribute, display, perform publicly, commercialize, and create solutions to fix the Reported Vulnerabilities, improve the Products and marketing, sale, and promotion of such improved Products;
- We may request that you, upon mutual consent, sign an additional document for us or our designees to confirm our rights described above;
- We do not expect you to create and provide any solution for Reported Vulnerabilities affecting our Products, whether separately or as part of the Reported Vulnerabilities. We may develop or commission materials as part of our solution for Reported Vulnerabilities that show similarity to your possible solutions, whether part of the Reported Vulnerabilities or not, and you hereby waive any claims against us, our distributors, resellers, and customers that may have resulted from any similarities of our materials to the Reported Vulnerabilities;
- We shall not pay any compensation or guarantee any credit to you for our use of the Reported Vulnerabilities; and
- You represent that we can use the Reported Vulnerabilities for our policy and work concerning our Products without any restrictions. You will inform us when the Reported Vulnerabilities contain information and/or materials owned by another person or entity, and any limitation to your legal right to provide the Reported Vulnerabilities to us.
- You represent that the Reported Vulnerabilities do not contain any personal data. “Personal data” means information relating to identified or identifiable living individuals and includes personally identifiable information excluding your business e-mail address, business phone number and/or business address disclosed in connection with providing Reported Vulnerabilities. We will remove all such information when we deem it not necessary to contact you regarding the Reported Vulnerabilities.