Investigating: OpenSSL DROWN security issue

Incident Report for BigCommerce

Resolved

Bigcommerce engineers have confirmed that the Bigcommerce platform and all stores are not affected by the recently announced "DROWN" SSL vulnerability. The vulnerability targets an old SSL protocol (SSLv2) which is not supported on the Bigcommerce platform.

Posted Mar 01, 2016 - 09:33 CST

Investigating

A new security vulnerability has been found with many implementations of SSL. In this case, the vulnerability is with SSL libraries that allow the use of SSLv2. Bigcommerce engineers are aware of the issue and auditing our servers to ensure we are not vulnerable to this new attack. Further details on the attack are available here for the technically curious: https://www.drownattack.com.

Posted Mar 01, 2016 - 08:59 CST

This incident affected: Storefront.