Evolution of OpenSSL Security After Heartbleed

guest · Dec 26, 2019

Evolution of OpenSSL Security After Heartbleed
OpenSSL has evolved a great deal in terms of security since the disclosure of the Heartbleed vulnerability back in 2014
December 26, 2019
https://www.securityweek.com/evolution-openssl-security-after-heartbleed

OpenSSL, an open source library that implements the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols, is widely used by organizations to protect communications.

In April 2014, the world learned that OpenSSL was affected by a critical vulnerability, dubbed Heartbleed and tracked as CVE-2014-0160 [...]

“The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software,” the researchers who discovered Heartbleed wrote on a website dedicated to the vulnerability.
In the aftermath of Heartbleed, the OpenSSL Project also started focusing on code quality and introduced a mandatory code review process for all commits, ensuring that every line of code is verified by at least two experienced developers before being accepted.

“With the added community engagement that we have had, it has freed us up to be able to rewrite significant portions of the library that were in need of update,” Caswell said. “For example over recent years the SSL/TLS state machine has been completely rewritten, and we have a brand new, high quality, random number generation component.”
Click to expand...

In fact, one of the two groups awarded the Levchin prize for Real World Cryptography in 2018 was the OpenSSL team, recognized for the “dramatic improvements to the code quality of OpenSSL.”
Click to expand...

Log in or Sign up

Evolution of OpenSSL Security After Heartbleed

guest Guest

Log in or Sign up

Evolution of OpenSSL Security After Heartbleed

guest Guest

Useful Searches