Achieving CISA BOD 25-01 Compliance and SCuBA Alignment

How SaaS Vendors Are Handling the OpenSSL Critical Flaw

By

AppOmni

All aspects of the OpenSSL critical vulnerability patch will be managed by AppOmni

Today, the OpenSSL Project released a patch to address a “critical” vulnerability formally known as CVE-2022-3786. This marks only the second time since the OpenSSL Project’s inception in 1998 that the organization has announced a critical vulnerability, its most severe designation.

OpenSSL’s broad reach means the patch must be installed across servers, laptops, on-prem software, and much more to prevent issues with software libraries, private keys, certificate signing requests (CSRs), SSL/TLS certificates, and identify certificate information.

An OpenSSL Project critical vulnerability “affects common configurations … which are also likely to be exploitable.” The official definition goes on to include examples that can potentially reveal user details and server data, among other distressing scenarios.

Thankfully, organizations with a “SaaS first” stack are largely protected from any OpenSSL issues related to this vulnerability.

Why SaaS App Owners and Users Are Unaffected by the OpenSSL Vulnerability

Well-established SaaS companies take responsibility for remediating OpenSSL concerns (assuming any exist) in their SaaS apps. Even if your team deploys custom code that relies on OpenSSL libraries, such as Salesforce’s Apex, the SaaS vendor is responsible for the libraries used by the runtime that executes the code.AppOmni and other respected SaaS companies use a shared responsibility model. Unlike on-prem software, a SaaS vendor maintains the solution’s infrastructure, network, and application. The customer manages application configuration for the SaaS platform – the “shared” portion of shared responsibility. And SaaS companies employ Security and DevSecOps teams to hunt for SaaS-to-SaaS bugs and vulnerabilities.

Steps You Should Take Now

If you rely on on-prem software, contact your security and IT teams immediately to ensure they’re managing the OpenSSL patches. This discussion is particularly urgent if business-critical programs run in on-prem environments.

Unfortunately, emerging and up-and-coming SaaS vendors may not fully adhere to the shared responsibility model, or they might not have hired security experts to monitor for these events. Don’t hesitate to ask if they’ve identified any OpenSSL vulnerabilities and patched them.

OpenSSL Critical Vulnerability Responses and Resources

If major SaaS companies share their plans for addressing this patch, we’ll continually update this section. If you’d like to submit a vendor response for us to post here, please send the details to info@appomni.com.

To better understand the full impact of the OpenSSL critical flaw, check out these resources:

Related Resources