4

As an IT professional, I am very concerned at the news that Heartbleed can exploit weaknesses in the OpenSSL architecture. Is there any risk to users logging onto Salesforce via browser or app?

11

There was a salesforce known issue around this that states the following:

At salesforce.com, trust is our #1 value and we take the protection of our customers' data very seriously. On April 7, the OpenSSL Project released an update to address a vulnerability nicknamed “Heartbleed". Salesforce is not running the vulnerable version of OpenSSL and there is no impact to the Salesforce service.

I've not seen any other public facing statements.

  • Note that "is not running" refers to the time after the patch release. So this suggests that possibly one of the vulnerable versions was in use before; the claim is not that they were never affected (e.g. used a version without heartbeat at all or non-OpenSSL code). So a principal risk is involved with having logged in, not with logging in now. – Hagen von Eitzen Apr 15 '14 at 18:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.