The heartbleed bug was introduced in OpenSSL 1.0.1 and is present in
- 1.0.1
- 1.0.1a
- 1.0.1b
- 1.0.1c
- 1.0.1d
- 1.0.1e
- 1.0.1f
The bug is not present in 1.0.1g, nor is it present in the 1.0.0 branch nor the 0.9.8 branch of OpenSSL some sources report 1.0.2-beta is also affected by this bug at the time of writing, however it is a beta product and I would really recommend not to use beta quality releases for something as fundamentally important as OpenSSL in production.
The bug itself is within the heartbeat extension of OpenSSL (RFC6520). The bug allows an attacker to leak the memory in up to 64k chunks, this is not to say the data being leaked is limited to 64k as the attacker can continually abuse this bug to leak data, until they are satisfied with what has been recovered.
At worst the attacker can retrieve the private keys, the implications for which is that the attacker now has the keys to decrypt the encrypted data, as such the only way to be 100% certain of protection against this bug is to first update OpenSSL (>= 1.0.1g) and then revoke and regenerate new keys and certificates, expect to see a tirade of revocations and re-issuing of CA certs and the like in the coming days.
You can find your version easily via your package manager for example:
- rpm -q openssl
- dpkg-query -W openssl
If you’re running a vulnerable installation of OpenSSL an update will be required.
- update OpenSSL >= 1.0.1g
- 1.0.1e-2+deb7u5 is reported as patched on debian,
- 1.0.1e-16.el6_5.7 is reported as patched in RedHat and CentOS
- 1.0.1e-37.66 changelogs note this has been patched on Amazon AMI
You can read more about the heartbleed bug at heartbleed.com Redhat Bugzilla Mitre CVE filing Ubuntu Security Notice