ubuntu:vulnerabilities:heartbleed
Differences
This shows you the differences between two versions of the page.
| Next revision | Previous revision | ||
| ubuntu:vulnerabilities:heartbleed [2019/12/04 22:20] – created peter | ubuntu:vulnerabilities:heartbleed [2020/07/15 09:30] (current) – external edit 127.0.0.1 | ||
|---|---|---|---|
| Line 3: | Line 3: | ||
| Heartbleed was introduced in OpenSSL version 1.0.1 and is patched with OpenSSL version 1.0.1g. | Heartbleed was introduced in OpenSSL version 1.0.1 and is patched with OpenSSL version 1.0.1g. | ||
| - | The bug allows any attacker to read the memory of a vulnerable host, which means that any keys that have been used on a host with a vulnerable version of OpenSSL should be considered compromised. | + | The bug allows any attacker to read the memory of a vulnerable host, which means that any keys that have been used on a host with a vulnerable version of OpenSSL should be considered compromised. |
| + | |||
| + | Distributions have been updating their packages and pushing out updates, but users need to pull down the most recent packages and revoke any previous keys based on insecure versions. | ||
| ---- | ---- | ||
| Line 10: | Line 12: | ||
| <code bash> | <code bash> | ||
| - | dpkg -l | grep " | + | sudo dpkg -l | grep " |
| </ | </ | ||
| - | Returns something like: | + | returns: |
| < | < | ||
| Line 62: | Line 64: | ||
| These may look different, but they should point you in the correct direction to find your SSL certificate location. | These may look different, but they should point you in the correct direction to find your SSL certificate location. | ||
| + | |||
| + | ---- | ||
| If you are using Nginx, you'll find similar directives that point to your server' | If you are using Nginx, you'll find similar directives that point to your server' | ||
ubuntu/vulnerabilities/heartbleed.1575498011.txt.gz · Last modified: 2020/07/15 09:30 (external edit)