4

As an IT professional, I am very concerned at the news that Heartbleed can exploit weaknesses in the OpenSSL architecture. Is there any risk to users logging onto Salesforce via browser or app?

1 Answer 1

11

There was a salesforce known issue around this that states the following:

At salesforce.com, trust is our #1 value and we take the protection of our customers' data very seriously. On April 7, the OpenSSL Project released an update to address a vulnerability nicknamed “Heartbleed". Salesforce is not running the vulnerable version of OpenSSL and there is no impact to the Salesforce service.

I've not seen any other public facing statements.

1
  • Note that "is not running" refers to the time after the patch release. So this suggests that possibly one of the vulnerable versions was in use before; the claim is not that they were never affected (e.g. used a version without heartbeat at all or non-OpenSSL code). So a principal risk is involved with having logged in, not with logging in now. Commented Apr 15, 2014 at 18:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .