topic Re: Heartbeat Open SSL Vulnerability - what is Alfresco doing in response in Alfresco Archive

Heartbeat Open SSL Vulnerability - what is Alfresco doing in response

dmertz123 — Thu, 10 Apr 2014 19:57:39 GMT

Assuming the servers which are hosting alfresco are Linux based, have the servers been checked to see if they are vulnerable to the OpenSSL heartbeat vulnerability? When were the servers updated?What else is being done to pre-emptively address possibly exposed certificates, passwords, encryption ke

Re: Heartbeat Open SSL Vulnerability - what is Alfresco doing in response

petep — Fri, 11 Apr 2014 08:40:15 GMT

Thanks for the enquiry. I can confirm that all servers at Alfresco have been patched and all necessary authentication tokens rotated. Please see our statement on the matter at https://portalalfresco.secure.force.com/articles/en_US/Security_Bulletin/OpenSSL-vulnerability-Heartbleed-Bug

Re: Heartbeat Open SSL Vulnerability - what is Alfresco doing in response

mrogers — Fri, 11 Apr 2014 08:44:39 GMT

Patches have been applied.

I'm not in a position to give further details and wouldn't post specific security details anyway.

Re: Heartbeat Open SSL Vulnerability - what is Alfresco doing in response

jpotts — Fri, 11 Apr 2014 14:37:26 GMT

For folks who cannot log in to the support portal, Pete has added a post in the Announcements forum here:
http://forums.alfresco.com/forum/general/announcements/heartbleed-ssl-vulnerability-cve-2014-0160-04112014-1429

Jeff