Change Notification

This status page is no longer updated. For Apigee Edge and OPDK service incidents, please visit Google Cloud Service Health page.

To subscribe to product updates and release notes, please visit the Apigee release notes page.

Apigee OpenSSL Update

Scheduled Maintenance Report for Apigee

Completed

The scheduled maintenance has been completed.

Posted Aug 30, 2023 - 10:37 PDT

In progress

Scheduled maintenance is currently in progress. We will provide updates as necessary.

Posted Nov 02, 2022 - 16:45 PDT

Scheduled

On this page, we provide the latest update of the potential impact of the recently announced OpenSSL vulnerabilities(https://www.openssl.org/blog/blog/2022/11/01/email-address-overflows/) on Apigee products and services. Investigations are ongoing as this is a developing event. We will continue to assess potential impact as we learn more, and we will update this post with details on any impacted Apigee products and services.

As Apigee components do not explicitly install the OpenSSL package in the base images, Apigee products are not found to be impacted with the OpenSSL vulnerability reported on OpenSSL 3.x.

As of this publication, we have found no evidence of any exploitation activities.

Background:
On November 1, the OpenSSL project team released (https://www.openssl.org/blog/blog/2022/11/01/email-address-overflows/) OpenSSL version 3.0.7 to fix two vulnerabilities in OpenSSL 3.0.x. OpenSSL initially suggested (https://mta.openssl.org/pipermail/openssl-announce/2022-October/000238.html) that the pending release would resolve a critical vulnerability. The version 3.0.7 release, however, assigned a high severity to both vulnerabilities. This assessment was based on further technical review and alignment with OpenSSL’s security policies (https://www.openssl.org/policies/general/security-policy.html).

We’ll share more information with customers as it becomes available and update this page with the results of our investigation and any guidance if appropriate.

Please also refer to Google Cloud Security Advisory at https://cloud.google.com/openssl-security-advisory

Posted Nov 02, 2022 - 16:41 PDT