Heartbleed (CVE-2014-0160)

Heartbleed is the name of CVE-2014-0160, a bug in OpenSSL's implementation of the TLS heartbeat extension. A client could claim a longer payload than it actually sent, and the vulnerable server replied with extra bytes from its own memory, up to roughly 64 KB per request.

Why it matters

Heartbleed is the standard example of why a TLS library bug is worse than a site bug. The leaked memory could contain session cookies, passwords and even the server's private key, and the requests left no obvious trace in normal logs. It affected OpenSSL 1.0.1 through 1.0.1f and was fixed in 1.0.1g in April 2014. Because the private key could have been exposed, patching alone was not enough: operators had to replace certificates and revoke the old ones.

Example

The remediation checklist after a vulnerable server was found:

1. Upgrade OpenSSL and restart every service linked against it.
2. Generate a new private key and request a new certificate.
3. Revoke the old certificate.
4. Invalidate sessions and prompt users to change passwords.

Common mistakes

• Patching the library but not restarting daemons that still hold the old code in memory.
• Reissuing the certificate with the same private key, which leaves the compromised key in use.
• Assuming it only matters for historical systems. Old appliances and embedded devices can still run vulnerable builds.

Related

• Private key
• Certificate revocation list
• Zero-day
• CVE

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.