I noticed that many people still use versions affected by the heartbleed vulnerability of wide spread TLS/SSL enabled Windows clients like WinSCP and Filezilla.
To be able to make safe recommendations, I want to have a list with safe versions.
Probably there are old versions which use OpenSSL before 1.0.1 (see http://heartbleed.com/) that seem safe to use (if there are no other reasons not to use them).
For example WinSCP 5.5.3 (not released yet) will be safe with TLS/SSL core upgraded to OpenSSL 1.0.1g.
WinSCP 4.3.7 seems to be not yet affected because it has OpenSSL before 1.0.1, can someone confirm this and is there a later version that works?
What about Filezilla?