When a third-party update, also called a patch is available to mitigate a security vulnerability, Avaya might recommend that the customer apply the patch from the third-party. This action, if recommended, is stated explicitly in the Avaya Security Advisory.
For some third-party updates, Avaya might not recommend installation due to interoperability, stability, or reliability issues with the update and Messaging. In this case, before Avaya releases a security update, Avaya thoroughly tests it on a non-production system, along with all the other software that is normally loaded (and not loaded) on a Messaging server. Sometimes Avaya must modify the update before it works correctly. Customers who apply third-party provided patches without Avaya’s recommendation might void their warranty.
In some instances, when a software vendor provides an update to address a vulnerability, Avaya might decide to address the vulnerability through other means to avoid potential risks to Messaging. This might include modification of existing software through an Avaya-issued update which is released separately or incorporated into future releases of the product. Such decision to offer an alternative remediation is described in the advisory.