Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

As an IT professional, I am very concerned at the news that Heartbleed can exploit weaknesses in the OpenSSL architecture. Is there any risk to users logging onto Salesforce via browser or app?

share|improve this question
up vote 11 down vote accepted

There was a salesforce known issue around this that states the following:

At, trust is our #1 value and we take the protection of our customers' data very seriously. On April 7, the OpenSSL Project released an update to address a vulnerability nicknamed “Heartbleed". Salesforce is not running the vulnerable version of OpenSSL and there is no impact to the Salesforce service.

I've not seen any other public facing statements.

share|improve this answer
Note that "is not running" refers to the time after the patch release. So this suggests that possibly one of the vulnerable versions was in use before; the claim is not that they were never affected (e.g. used a version without heartbeat at all or non-OpenSSL code). So a principal risk is involved with having logged in, not with logging in now. – Hagen von Eitzen Apr 15 '14 at 18:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.