TIBCO Cloud Mashery API Developer Blog

Mashery addressed the SSLv3 vulnerability aka Poodle in our environment within few hours of learning about it on the afternoon of October 14th 2014. After carefully reviewing the likelihood and impact of this vulnerability, we determined the risk to be High, especially as “Poodle” became a widely known vulnerability that could potentially expose our customers’ data. We decided to disable SSLv3 immediately with an option to rollback on a customer case-by-case basis.

Prior to disabling SSLv3, we informed our customers about our decision and made that change (i.e., disabling SSLv3) during our weekly maintenance window (11 PST 11/14/14) on the same day. We also recommended our customers to use TLS 1.0 or above as per the industry best practice. Follow up communications were sent to our customers to keep them abreast on the status of the change.

We did not come across any significant interruptions due to disabling SSLv3 in our own, or our customers’, operations. We made every effort to address customer issues as early as possible. Only a very small number of customers reported issues caused by the necessary change.

As always, customers’ information security has always been one of our top priorities and we will continue to do our part to safeguard customer data.

Please contact customer support at support@mashery.com, TIBCO Mashery Support Portal, or call our toll free number: 888-667-1588. You can also follow our updates on our Twitter stream, @MasheryOps.

For more information about this vulnerability, please refer to http://googleonlinesecurity.blogspot.com/2014/10/this-poodle-bites-exploiting-ssl-30.html.