Security vulnerability in OpenSSL allowing an attacker to obtain SSL keys, passwords, and other secure data from a server or client
Heartbleed (CVE-2014-0160) is a major security vulnerability in the OpenSSL library which allows an attacker to obtain the memory contents of a server or client using the OpenSSL library for securing its transport. This data may include SSL private keys, passwords, and web pages that were recently served or visited, thereby defeating the security provided by SSL. The vulnerability affected a large portion of websites which provide HTTPS support, including Yahoo! and Imgur.
Not only webservers are vulnerable, other services using OpenSSL for transport security are affected, for example mail servers (SMTP, IMAP, POP3) and VPN servers (OpenVPN) are also affected.
The vulnerability was patched in an update released on April 7, 2014 according to the OpenSSL Security advisory. Many websites have quickly patched the update, but the vulnerability has been present for more than two years and may have been exploited before it was announced. More information about the Heartbleed vulnerability is available at http://heartbleed.com/.
