5 ms·

Most reports about Heartbleed kept repeating that the vulnerability was introduced 2 years ago (Dec '12, which isn't even 2 years - but anyway) it was committed

by nikcub 13y ago

Most reports about Heartbleed kept repeating that the vulnerability was introduced 2 years ago (Dec '12, which isn't even 2 years - but anyway) it was committed to a version of OpenSSL (v1.0.1) that wasn't widely distributed until the middle of last year. The time surface of the Heartbleed attack is a lot smaller than what most think. Debian and the BSD projects moved to v1.0.1 earliest, around March/April last year. Ubuntu only upgraded two months ago (in 12.04.4) on the 6th of Feb: http://fridge.ubuntu.com/2014/02/06/ubuntu-12-04-4-lts-released/ http://fridge.ubuntu.com/2014/02/06/ubuntu-12-04-4-lts-relea... Redhat with 6.5 in November 2013: https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.5_Release_Notes/bh-chap-security.html https://access.redhat.com/site/documentation/en-US/Red_Hat_E... CentOS Feb 26th 2014: http://wiki.centos.org/Manuals/ReleaseNotes/CentOS6.5 http://wiki.centos.org/Manuals/ReleaseNotes/CentOS6.5

awda 13y ago
Fedora has been on OpenSSL 1.0.1 since maybe March 14, 2012 (that was when the .spec was bumped, anyway)[0]. So quite a long window for Fedora users, unfortunately. [0]: http://pkgs.fedoraproject.org/cgit/openssl.git/commit/?h=f18&id=0f0ab241767afcda7d3a21a5b8e7bc770516f2ea http://pkgs.fedoraproject.org/cgit/openssl.git/commit/?h=f18...
- awda 13y ago
  Whoah, downvote for this? I thought this was factual and helpful... if you disagree, can you at least let me know what's wrong? Thanks. For more details: Fedora 18 shipped with OpenSSL 1.0.1c on 11-Sep-2012: http://mirrors.kernel.org/fedora/releases/18/Everything/x86_64/os/Packages/o/ http://mirrors.kernel.org/fedora/releases/18/Everything/x86_.... So that's 18 months of exposure for Fedora users (including me).
acqq 13y ago
It's apparently Dec 2011 not Dec 2012, if we look at the date of the now famous commit: http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=4817504d069b4c5082161b02a22116ad75f822b1 http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=4817... "Sat, 31 Dec 2011 22:59:57 +0000 Support for TLS/DTLS heartbeats. 20 files changed"
LukeShu 13y ago
> 2 years ago (Dec '12, which isn't even 2 years - but > anyway) It was Dec 31 '11, not '12, that the commit was made--more than 2 years ago. It first appeared in the OpenSSL 1.0.1 release; March 14, 2012. I don't know what's up with the timestamp on the Ubuntu announcement, but 12.04 was released in April 2012. However, that's before the OpenSSL 1.0.1 date; the Ubuntu 12.04.4 update for openssl 1.0.1-2ubuntu1 came on March 22, 2012. No matter how you slice it, that's more than 2 years. Edit: Ubuntu 12.04 was April 2012, but the 12.04.4 point-release was released at the later date; that's where the 2014 date came from. 12.04 included OpenSSL 1.0.1 before that.

by nikcub 13y ago

awda 13y ago

Fedora has been on OpenSSL 1.0.1 since maybe March 14, 2012 (that was when the .spec was bumped, anyway)[0]. So quite a long window for Fedora users, unfortunately. [0]: http://pkgs.fedoraproject.org/cgit/openssl.git/commit/?h=f18&id=0f0ab241767afcda7d3a21a5b8e7bc770516f2ea http://pkgs.fedoraproject.org/cgit/openssl.git/commit/?h=f18...

awda 13y ago
Whoah, downvote for this? I thought this was factual and helpful... if you disagree, can you at least let me know what's wrong? Thanks. For more details: Fedora 18 shipped with OpenSSL 1.0.1c on 11-Sep-2012: http://mirrors.kernel.org/fedora/releases/18/Everything/x86_64/os/Packages/o/ http://mirrors.kernel.org/fedora/releases/18/Everything/x86_.... So that's 18 months of exposure for Fedora users (including me).

acqq 13y ago

It's apparently Dec 2011 not Dec 2012, if we look at the date of the now famous commit: http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=4817504d069b4c5082161b02a22116ad75f822b1 http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=4817... "Sat, 31 Dec 2011 22:59:57 +0000 Support for TLS/DTLS heartbeats. 20 files changed"

LukeShu 13y ago

> 2 years ago (Dec '12, which isn't even 2 years - but > anyway) It was Dec 31 '11, not '12, that the commit was made--more than 2 years ago. It first appeared in the OpenSSL 1.0.1 release; March 14, 2012. I don't know what's up with the timestamp on the Ubuntu announcement, but 12.04 was released in April 2012. However, that's before the OpenSSL 1.0.1 date; the Ubuntu 12.04.4 update for openssl 1.0.1-2ubuntu1 came on March 22, 2012. No matter how you slice it, that's more than 2 years. Edit: Ubuntu 12.04 was April 2012, but the 12.04.4 point-release was released at the later date; that's where the 2014 date came from. 12.04 included OpenSSL 1.0.1 before that.