Apigee Release Schedule

Apigee Edge: Tue-Thu 12am to 4am in Singapore, Central European, and US Eastern time zones (learn more)

Read the release notes to learn what is new.

Poodle vulnerability CVE-2014-3566
Incident Report for Apigee
Resolved
This incident has been resolved.
Posted Dec 10, 2014 - 17:15 PST
Monitoring
Poodle is a vulnerability in the SSL 3.0 protocol used in SSL encrypted communications. Officially, its reported as CVE-2014-3566. Detailed information on the attack can be found at any of the following sites:

http://poodlebleed.com/
https://www.openssl.org/~bodo/ssl-poodle.pdf

Apigee allows the use of SSL 3.0 in the configuration of secure connections into the Apigee Edge platform. At the time of this announcement, Apigee is not aware of any active exploitation of this flaw. However, the protocol (SSL 3.0) is still vulnerable and its use should be deprecated as soon as possible for all Apigee customers.

Apigee recommends that all customers stop the use of SSL v3.0 in their configurations.

For cloud customers, this can be accomplished by opening a support ticket with Apigee Support and requesting your SSL configuration be updated to not allow SSL v3.0.

For on-premises customers, the change would need to be made where your SSL termination is done - often inside of a load balancer. The process to complete this will depend on the systems used for SSL and assistance should be obtained from your load balancer or SSL vendor.
Posted Oct 15, 2014 - 10:40 PDT