[calypso]

Iskreno, cijela ta prica o Heartbleedu je zesca glupost. Vulnerability scanneri ga smatraju Severity 4 problemom, a ne 5, dakle nije kriticno za hitno patchiranje. U principu, ako patchiras unutar 30 dana ce ti security auditori reci da si OK postupio, ionako je vec 2 godine aktivan.

Sto tocno Heartbleed bug radi je receno u sljedecoj recenici - 'permitting attackers to read up to 64 kilobytes of the victim's memory that was likely to have been used previously by OpenSSL'. Sad, ako neko moze izvuci nesto koristno iz 64kB random podataka, svaka mu cast.

Pred par dana su mi vulnerability scanneri poceli vikat za jos jedan Severity 4 problem (zapravo vise njih) vezan uz OpenSSL - OpenSSL Multiple Remote Security Vulnerabilities. Ovaj me malo vise brine.

CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470, CVE-2014-0076