Revenera Response to Salesloft Drift Security Incident

Revenera is aware of the recent security incident involving the Drift application, an AI-enabled product offered by Salesloft. According to public reports and communications from Salesforce and other affected parties, the incident involved unauthorized access via compromised authentication tokens, potentially impacting integrations with Salesforce and other third-party platforms.

We would like to clarify that Revenera does not use the Drift product from Salesloft, which is the application identified as impacted in this incident. While Revenera does utilize Salesloft's core platform, we have received no indication from Salesloft or Salesforce that the core Salesloft product is within scope of the breach.

As a precautionary measure, Salesforce has temporarily disconnected the Salesloft integration to ensure the Drift-related incident is fully contained and resolved. Revenera is actively working with both Salesloft and Salesforce to monitor the situation and validate that our systems remain secure.

At this time, Revenera has not identified any compromise or impact to our Salesforce environment or customer data as a result of this incident. We remain committed to maintaining the highest standards of security and transparency. 

If you have any questions or concerns, please contact Revenera Technical Support or your trusted Revenera contact.

Revenera officially announces Dynamic Monetization, a new cloud service that allows technology companies to introduce flexible monetization models for connected software and devices. The first supported model is Elastic Access, which provides a fresh dimension to revenue generation in an increasingly complex landscape, marked by the growth of subscription models and SaaS deployments.

We are happy to share that Flexera, parent company of Revenera, has completed its acquisition of Snow Software. Rest assured this acquisition does not change how you do business with Revenera. Revenera, its products, and its dedication to its' customers' success remains as it does today. 

If you'd like to learn more about the acquisition, please see the Flexera blog post and press release below:

• Blog Post: flexera | snow
• Press Release: Flexera Completes Acquisition of Snow Software

(Latest Update 2023-Nov-07 16:06 CDT)

A remote code execution vulnerability (CVE-2023-46604 ) was identified in Apache ActiveMQ. This article provides the latest information regarding Revenera's products' potential exposure to the vulnerability (if any) and plans for remediation, if necessary.

NOTE: This is an ongoing assessment. Updates will be made to this advisory as further information becomes available.

The information on this page reflects:

• The assessed status of all versions of Revenera’s products that are still supported (that is, they have not yet reached their End of Life). Product lifecycle dates can be found at https://docs.revenera.com/eol/default.htm .

• Official Apache advisory: https://activemq.apache.org/security-advisories.data/cve-2023-46604-announcement.txt
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=2023-46604

2023-11-03 11:35 CDT: Initial advisory posted.

2023-11-07 16:06 CDT: Published product assessment.

Initial Advisory (posted on Nov 03, 2023 11:35 AM CDT)

We are aware of the recent ActiveMQ security vulnerability (CVE-2023-46604 ) and are assessing which of our products may be impacted.

The official announcement from Apache can be found at https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt .

Please subscribe to this page to be notified of subsequent updates. Thank you for your patience.

(Latest Update 2023-Nov-17 17:47 CDT)

The cURL 8.4.0 patch has been released and we're continuing to assess Revenera product impact and if any remediation work is required.

• CVE-2023-38545 (Severity HIGH): This defect allows potential heap based buffer overflow in the SOCKS5 proxy handshake. This issues affects libcurl versions 7.69.0 to and including 8.3.0.

• CVE-2023-38546 (Severity: LOW): If certain conditions are in effect, this defect may allow a cookie injection attack on a running program using libcurl. This defect affects libcurl versions 7.9.1 to and including 8.3.0. 

If you need to patch cURL on your own servers or environment, the patch files are available at https://curl.se/download.html.

C-XT: All versions

Non C-XT: Versions prior 2023.09

C-XT: FlexNet Embedded 2023.09.1

Non C-XT: FlexNet Embedded 2023.09

The information on this page reflects:

• The assessed status of all versions of Revenera’s products that are still supported (that is, they have not yet reached their End of Life). Product lifecycle dates can be found at https://docs.revenera.com/eol/default.htm.

• GitHub Announcement of cURL Vulnerabilities
• https://curl.se/docs/CVE-2023-38545.html
• https://curl.se/docs/CVE-2023-38546.html

• 2023-12-7 13:11 CDT: Published final product assessment.
• 2023-10-10 13:03 CDT: Initial advisory posted.
• 2023-10-11 18:07 CDT: Update regarding cURL 8.4.0 patch and ongoing product assessment.
• 2023-10-12 11:13 CDT: Published initial product assessment.
• 2023-10-18 13:38 CDT: Updated assessment for FlexNet Embedded LLS and Usage Intelligence products to not affected.
• 2023-10-26 09:55 CDT: Updated assessment for FlexNet Operations Cloud ALM to not affected.
• 2023-11-17 17:47 CDT: Updated product assessment for FlexNet Embedded. 

Initial Advisory (posted on Oct 10, 2023 11:03 AM)

We are aware of the recent cURL security vulnerabilities (CVE-2023-38545 and CVE-2023-38546) and are assessing which of our products may be impacted.

Once specific details regarding the impacted versions of cURL are released on October 11th, we will reconcile that with our analysis and provide further updates on any necessary remediation work. Please subscribe to this page to be notified of subsequent updates.

Thank you for your patience.

We are happy to announce that ComponentSource has presented our Software Installation business with several achievements from their 2023 Awards for both leading publishers and individual products:

• Revenera – Top 25 Publisher
• InstallShield – Top 50 Product Award
• InstallShield Premier – Top 50 Product Award
• InstallAnywhere – Top 100 Product Award

For more information about ComponentSource and the honor bestowed upon our Software Installation solutions, please visit the announcement on the Software Installation blog .