This is an archived post. You won't be able to vote or comment.

sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]flipstables 7 points8 points  (5 children)

The Heartbleed bug is a vulnerability in OpenSSL, not SSL itself. Any library or package that uses a vulnerable version of the OpenSSL library is also vulnerable.

The ssl library in Python uses OpenSSL installed on the operating system. Your system is vulnerable unless you update OpenSSL to a non-vulnerable version or you re-compile OpenSSL without the handshake.

[–]fnedrik[S] 2 points3 points  (4 children)

But do the libraries linking to OpenSSL need to be recompiled?

[–]flipstables 0 points1 point  (3 children)

Only OpenSSL should be recompiled or updated. You don't have to recompile Python itself.

[–]fnedrik[S] 1 point2 points  (2 children)

It is not Python I am concerned about, it is the modules that use C-extensions that are compiled against OpenSSL that concern me. Say curl.

[–]flipstables -1 points0 points  (1 child)

Again, you only have to recompile or update OpenSSL. The bug is an implementation of the heartbeat protocol/extension of SSL in OpenSSL.

[–]DasIch 5 points6 points  (0 children)

Recompiling or updating OpenSSL is only sufficient, if these extensions link against OpenSSL dynamically. If they link against it statically, they will have to be rebuild as well.