Sep 12, 2019

Heartbleed is a security bug in the OpenSSL cryptography library, which is a widely used implementation of the Transport Layer Security (TLS) protocol. It was introduced into the software in 2012 and publicly disclosed in April 2014. Heartbleed may be exploited regardless of whether the vulnerable OpenSSL instance is running as a TLS server or The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. Heartbleed was caused by a flaw in OpenSSL, an open source code library that implemented the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols. In short, a malicious user OpenSSL versions 1.0.1 through 1.0.1f contain a flaw in its implementation of the TLS/DTLS heartbeat functionality. This flaw allows an attacker to retrieve private memory of an application that uses the vulnerable OpenSSL library in chunks of 64k at a time. CVE-2014-0160 - Heartbleed. Late Monday, April 7th, 2014, a bug was disclosed in OpenSSL's implementation of the TLS heartbeat extension. The bug's official designation is CVE-2014-0160, it has also been dubbed Heartbleed in reference to the heartbeat extension it affects.

Consider if a SSL site has been vulnerable to Heartbleed and an attacker has stolen the encryption keys. If the OpenSSL is then patched, I think the Ssllabs check will show Green, even if the certificates have not been renewed after the patching.

Late Monday, April 7th, 2014, a bug was disclosed in OpenSSL's implementation of the TLS heartbeat extension. The bug's official designation is CVE-2014-0160, it has also been dubbed Heartbleed in reference to the heartbeat extension it affects. Anatomy of OpenSSL's Heartbleed: Just four bytes trigger Apr 09, 2014 SSL Server Test (Powered by Qualys SSL Labs)

Apr 09, 2014

Five years later, Heartbleed vulnerability still unpatched Sep 12, 2019 ssl-heartbleed NSE Script - Nmap PORT STATE SERVICE 443/tcp open https | ssl-heartbleed: | VULNERABLE: | The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. Heartbleed Attack Lab - SEED Project