Take the 2-minute tour ×
Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It's 100% free, no registration required.

As an IT professional, I am very concerned at the news that Heartbleed can exploit weaknesses in the OpenSSL architecture. Is there any risk to users logging onto Salesforce via browser or app?

share|improve this question
add comment

1 Answer 1

up vote 11 down vote accepted

There was a salesforce known issue around this that states the following:

At salesforce.com, trust is our #1 value and we take the protection of our customers' data very seriously. On April 7, the OpenSSL Project released an update to address a vulnerability nicknamed “Heartbleed". Salesforce is not running the vulnerable version of OpenSSL and there is no impact to the Salesforce service.

I've not seen any other public facing statements.

share|improve this answer
    
Note that "is not running" refers to the time after the patch release. So this suggests that possibly one of the vulnerable versions was in use before; the claim is not that they were never affected (e.g. used a version without heartbeat at all or non-OpenSSL code). So a principal risk is involved with having logged in, not with logging in now. –  Hagen von Eitzen Apr 15 at 18:16
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.