3 ms·
Why people are only talking about SSL keys? Because Heartbleed allowed to fetch any data, that could have also included SSH keys and or any other authentication
by Sami_Lehtinen 13y ago
Why people are only talking about SSL keys? Because Heartbleed allowed to fetch any data, that could have also included SSH keys and or any other authentication credentials / information the server got, for itself or to other services. As example if your site got Facebook API keys it's possible that those have been leaking too.
- jbg_ 13y agoUnless your web server makes SSH connections from some kind of in-process application, why would this bug allow SSH keys to leak?
- jevinskie 13y agoIs memory wiped with zeros by malloc/free in libc or in the kernel? If not, you're at risk.
- bzbarsky 13y agoYes, it is. Leaking memory contents across processes would be a pretty serious bug in the kernel. So when your process asks the kernel for memory (via sbrk or mmap) the memory it gets is zeroed out.
- tptacek 13y agoNo, your web server process memory does not include SSH keys.