Topic: Heartbleed Bug - SME Server 8.x NOT affected

[kruhm]

Hi,

So in the past 48 hours I've gotten more than 4 messages from vendors (FoxyCart, Mailchimp, Freshbooks, etc) about the Heartbleed Bug. It was even on the Today show.

There are a lot of different write ups about this. It looks as if the OpenSSL 0.9.8 branch is not vulnerable. So V8 should be fine.

Code: [Select]

# openssl version
OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008
And it looks like v9 has a concern that was already raised and patched by the quick acting CharlieBrady here:
http://bugs.contribs.org/show_bug.cgi?id=8318

Just looking for re-assurance that the OpenSSL in v8 is OK.

Thanks,

[CharlieBrady]

Just looking for re-assurance that the OpenSSL in v8 is OK.

You are correct, it is.

[hawk]

not sure of this is the correct web site to use but this is the link i used to test my servers, all passed

http://filippo.io/Heartbleed/

thanks
john

[wellsi]

Upstream have confirmed that RHEL 5, which is used in Cos 5 and therefore SME Server 8 are not affected.

http://www.openssl.org/news/secadv_20140407.txt
https://access.redhat.com/security/cve/CVE-2014-0160

From RedHat:
This issue did not affect the versions of openssl as shipped with Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6.4 and earlier, Red Hat JBoss Enterprise Application Platform 5 and 6, and Red Hat JBoss Web Server 1 and 2. This issue does affect Red Hat Enterprise Linux 6.5, Red Hat Enterprise Virtualization Hypervisor 6.5, and Red Hat Storage 2.1, which provided openssl 1.0.1e. Errata have been released to correct this issue.

https://access.redhat.com/site/announcements/781953

[Stefano]

FYI, I've just tested a SME 7.6 and it seems not affected too

[wellsi]

FYI, I've just tested a SME 7.6 and it seems not affected too

However there have been no updates for 7.6 for a long time as it went EOL last year. Anyone using 7.6 should really move to SME 8, or even SME 9 (if they are happy that SME 9 is still in Beta).

[CharlieBrady]

FYI, I've just tested a SME 7.6 ...

Doesn't sounds like a good use of your time ...

and it seems not affected too

We could have told you that...

[Stefano]

@Charlie.. I have many 7.x still working and online

[CharlieBrady]

@Charlie.. I have many 7.x still working and online

That doesn't sounds like something one should boast about.