4 ms·
The vulnerability is in OpenSSL only, and no major browser uses OpenSSL. Firefox and Chromium use NSS, IE uses a Microsoft library, and Safari uses Apple's Sec
by agwa 13y ago
The vulnerability is in OpenSSL only, and no major browser uses OpenSSL. Firefox and Chromium use NSS, IE uses a Microsoft library, and Safari uses Apple's SecureTransport.
Other OpenSSL-using clients are definitely vulnerable though - best bet to tell if you're vulnerable is to check the OpenSSL version.
- anonymfus 13y agoWhat about Opera 12, still major browser in CIS countries? OpenSSL license is listed on opera:about page, but version is not specified. How to find out?
- ce4 13y agoOpera 12 should be safe, as it doesn't support the heartbeat extension I tested it using openssl's s_server (with a quickly generated cert using tinyca) and then connecting to https://localhost:12345 https://localhost:12345 openssl s_server -accept 12345 -tlsextdebug -cert cert.pem | grep ^TLS TLS client extension "server name" (id=0), len=14 TLS client extension "renegotiation info" (id=65281), len=1 TLS client extension "status request" (id=5), len=5 TLS client extension "next protocol" (id=13172), len=0