Heartbleed bug affecting magento

Question

Are magento sites affected by heartbleed bugs and if yes what can I do for mitigation?

score 5 · Accepted Answer · answered Apr 13 '14 at 07:50

5

Heartbleed is server software (OpenSSL) bug so it's more like a server vulnerability.

Here is the link to check if your server is affected: http://filippo.io/Heartbleed/

The fix is just to upgrade OpenSSL to the newer version.

You can also mail your Magento customers asking for password change but this will be more of a panic.

answered Apr 13 '14 at 07:50

Tim Bezhashvyly

1

This hopefully goes without saying, but in at least three instances I've encountered folks upgraded OpenSSL and forgot to restart the servers. – kojiro Apr 13 '14 at 12:26

score 1 · Answer 2 · answered Apr 21 '14 at 10:03

Tim is correct, but I think the "panic" is correct.

Heartbleed opened your openSSL memory to the public, this means, everybody was able to read 16kb chunks of your memory. In this memory are stored:

This means, you have at least to upgrade your openssl version (as Tim said) AND change your private key!

Beside of this, attackers might be able to read the password and username, therefore resetting the passwords for all users is a good idea.

2 Answers2