Companies/Contentful/Incidents

Contentful: Meltdown & Spectre vulnerabilities update

Timeline of updates

1. resolved2018-01-05 15:33 UTC

   This week two serious vulnerabilities were disclosed that affect many modern CPUs [1]. This update is meant to give a security status assessment updated with all information we have collected on this incident, as of Friday the 5th of January 15:30 UTC. Contentful's server platform is hosted on virtual machines in the Amazon Web Services cloud. We use the "hardware virtualization" option exclusively, which is not vulnerable to Meltdown. In any case AWS have, through a series of actions in the last few days, patched their systems to protect malicious users from leveraging Meltdown gaining access to information from other customers hosted on the same cloud service [2]. Attacks based on Meltdown and Spectre require local access to execute code. Currently Contentful does not provide any option to run custom code so no third-party code can be run on our servers, therefore we believe the risk is mitigated through our existing security practices. In any event, we will install the operating system patches to protect against Meltdown and Spectre which are due to be released in the next few days. [1]: https://meltdownattack.com/ (opens in new tab) [2]: https://aws.amazon.com/security/security-bulletins/AWS-2018-013/ (opens in new tab)

From Contentful’s published incident history: for incidents before Rewindex began polling this status page, only the final update text is available.

Impact, status and times are the vendor’s own, as last archived. View on www.contentfulstatus.com (opens in new tab).

Contentful profileRecent Contentful incidentsAll outages on January 5, 2018Contentful in January 2018MarkdownJSON