2

A monthly report is being run by our client to check the security of their portal on Salesforce.

The report is run using TrustWave.

Problem: A threat that report shows is known as Sweet32 or the Birthday attack.

enter image description here

I have searched about it and have come to know that this is due the encryption, decryption, authentication or authorization protocols used by Salesforce, particularly this is DES-CBC3-SHA and this threat only occurs due to this protocol that Salesforce uses.

More here

Is there anything that I can do to prevent this?

Improve this question

1 Answer 1

Reset to default
1

Please see the following document: KB 000229896 Supported TLS Versions for Government Cloud. It contains the only other reference I could find to DES-CBC3-SHA encryption in the documentation.

While not explicitly stated, the article seemed to imply that this encryption suite is only there to support Government Cloud instances. It also stated that it does not support SSL at all. Instead, it only supports TLS. BTW, have you run a Checkmarx scan to see if the same threat is detected?

I recommend you file a case with Support to obtain clarification on whether the vulnerability exists or not. This could be a false positive. Trust and Security is one of Salesforce's highest priorities.

Improve this answer
1
  • Thanks @crmprogdev! I haven't run the Checkmarx scan but I have run the scans using Tenable.io and ZAP. They both show the same error though and just this one I believe I might have to file a case with support.
    – Mohit Arora
    Commented Jul 4, 2017 at 19:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .