---
title: "Preparing Our Response to the OpenSSL Security Flaw"
description: "Heroku prepared for an announced high-severity OpenSSL vulnerability whose details were embargoed until patch release. The team began by mapping exposure and system criticality, considering SSL clients, possible man-in-the-middle attacks, encrypted database connections, and worst-case remote code execution, then created stack-image update actions and priorities. Engineers were assigned responsibilities under the existing incident-response process, with communication rules, escalation criteria, paging, and availability planned in advance. When the OpenSSL update and vulnerability details arrived on July 9 at about 8am Central, triage showed it was neither an RCE nor server-side issue, and Ubuntu reported that neither LTS version was affected; because Heroku production used LTS, no remediation or all-hands response was needed. The preparation still exercised exposure review and response coordination for future incidents."
---

# Preparing Our Response to the OpenSSL Security Flaw

[Heroku](https://yomu.fyi/company/heroku) · Kevin Thompson · Jul 30, 2015

**Type:** Incident / postmortem

## Summary

Heroku prepared for an announced high-severity OpenSSL vulnerability whose details were embargoed until patch release. The team began by mapping exposure and system criticality, considering SSL clients, possible man-in-the-middle attacks, encrypted database connections, and worst-case remote code execution, then created stack-image update actions and priorities. Engineers were assigned responsibilities under the existing incident-response process, with communication rules, escalation criteria, paging, and availability planned in advance. When the OpenSSL update and vulnerability details arrived on July 9 at about 8am Central, triage showed it was neither an RCE nor server-side issue, and Ubuntu reported that neither LTS version was affected; because Heroku production used LTS, no remediation or all-hands response was needed. The preparation still exercised exposure review and response coordination for future incidents.

## Context

Heroku needed to prepare for an OpenSSL vulnerability announced before its details were disclosed. The unknown impact required reviewing possible exposure, system criticality, customer data risks, and the response process before the patch release.

## Approach / What changed

Heroku mapped affected systems, identified action items, assigned them to engineering teams, and established communication, escalation, paging, and availability plans. The security team re-triaged the issue after release and checked Ubuntu's LTS impact before deciding whether remediation or an all-hands response was necessary.

## Takeaways

- Heroku's SSL endpoints for hosted applications were ELBs provided by AWS, so potential ELB patching would be coordinated with Amazon.
- The response plan assigned explicit ownership, defined all-hands criteria, established communication procedures, and arranged for the security team to monitor information through the patch release.
- The released vulnerability was neither remote code execution nor server-side, and Ubuntu reported that neither LTS version was affected; because Heroku production used LTS, no remediation was required.

**Tags:** [Incident Response](https://yomu.fyi/topic/incident-response), [OpenSSL](https://yomu.fyi/topic/openssl), [Security](https://yomu.fyi/topic/security)

- Source: [Heroku](https://www.heroku.com/blog/preparing-for-major-response)
- Source URL: https://www.heroku.com/blog/preparing-for-major-response
- Ingested by Yomu: 2026-09-09T14:24:12.555Z

[Read original post](https://www.heroku.com/blog/preparing-for-major-response)