Hacker News Reader

Comment by zmillman | Hacker News Reader

Does anyone know how Amazon's Elastic Load Balancers are affected? I can't find anything on the AWS site

That is my concern as well. We are still running CentOS 6.4 which does not have the affected version of OpenSSL, but we terminate SSL at the ELB so if they are affected then are keys are not safe.

Edit: I've posted on the support forum, hopefully they get back to us https://forums.aws.amazon.com/thread.jspa?threadID=149690

I opened a support ticket, and Amazon just responded to say that yes, ELBs are vulnerable. I've posted their reply into that thread.

Any ELB deploys I've done in the last hour seem to be fixed.

The forum thread has just been updated with this reply:

"We can confirm that load balancers using Elastic Load Balancing SSL termination are vulnerable to the Heartbleed Bug (CVE-2014-0160) reported earlier today. We are currently working to mitigate the impact of this issue and will provide further updates."

Our AWS ELBs were compromised, but an hour or so ago we checked again and they were good. Now to regen the certs...

Likewise, same question for Rackspace's Cloud LBs.

Rackspace guy here. We have been digging in and it appears that we did have the impacted version of openssl installed but the heartbeat extension was disabled. Regardless, we have updated everything on the Cloud Load Balancer side to 1.0.1g. I will update here if we find anything different.

Rockin, thanks for the update!

Reply on news.ycombinator.com