(Yicai Global) Dec. 23 -- China’s Ministry of Industry and Information Technology has suspended an information-sharing partnership with Alibaba Cloud because the cloud computing unit of Alibaba Group Holding failed to report an open-source security vulnerability in a timely manner, according to The Paper.

The suspension will last for six months, The Paper said yesterday, citing sources close to the MIIT. The ministry said it would reconsider resuming the partnership based on what corrective changes Alibaba Cloud makes in the meantime, 21st Century Business Herald reported the same day. Hangzhou-based Alibaba Cloud has not yet responded to the reports.

Alibaba Cloud’s security team reported a remote code execution vulnerability with the popular open-source logging platform Apache Log4j 2 to the Apache Software Foundation on Nov. 24, according to a statement the Alibaba unit posted on its website on Dec. 17. The ministry said it received a report on the vulnerability from China’s cybersecurity watchdog on Dec. 9.

But according to China’s Internet Product Security Loophole Management Regulation, implemented in September, internet product providers should report vulnerabilities to the ministry’s cybersecurity threats and information-sharing platform within two days.

Alibaba’s shares [HKG: 9988] fell 1.4 percent in Hong Kong today to HKD113.30 (USD17.79) each, after its New York-listed stock [NYSE: BABA] retreated 4.2 percent to USD117.81 yesterday.

Apache Log4j 2 is a Java-based logging framework widely used for development. Due to recursive resolution in some of its features, attackers can construct malicious requests that trigger the remote code execution vulnerability.

Editor: Futura Costaglione, Xiao Yi