OpenSSL Heartbeat Information Disclosure Vulnerability

A vulnerability has been identified in OpenSSL. A remote, unauthenticated attacker may be able to retrieve sensitive information, such as secret keys. By leveraging this information, an attacker may be able to decrypt, spoof, or perform man-in-the-middle attacks on network traffic that would otherwise be protected by OpenSSL.  

A missing bounds check in the handling of the TLS heartbeat extension can be used to reveal up to 64k of memory to a connected client or server.

For details about the impact and how to verify whether your server or device is affected, please refer to our blog article:

/my_url/blog/14041501

Note: This vulnerability is being actively exploited in the wild.