Hacker News Reader

Comment by nikcub | Hacker News Reader

Most reports about Heartbleed kept repeating that the vulnerability was introduced 2 years ago (Dec '12, which isn't even 2 years - but anyway) it was committed to a version of OpenSSL (v1.0.1) that wasn't widely distributed until the middle of last year.

The time surface of the Heartbleed attack is a lot smaller than what most think. Debian and the BSD projects moved to v1.0.1 earliest, around March/April last year.

Ubuntu only upgraded two months ago (in 12.04.4) on the 6th of Feb:

http://fridge.ubuntu.com/2014/02/06/ubuntu-12-04-4-lts-relea...

Redhat with 6.5 in November 2013:

https://access.redhat.com/site/documentation/en-US/Red_Hat_E...

CentOS Feb 26th 2014:

http://wiki.centos.org/Manuals/ReleaseNotes/CentOS6.5

View on HN

Fedora has been on OpenSSL 1.0.1 since maybe March 14, 2012 (that was when the .spec was bumped, anyway)[0]. So quite a long window for Fedora users, unfortunately.

[0]: http://pkgs.fedoraproject.org/cgit/openssl.git/commit/?h=f18...

Whoah, downvote for this? I thought this was factual and helpful... if you disagree, can you at least let me know what's wrong? Thanks.

For more details: Fedora 18 shipped with OpenSSL 1.0.1c on 11-Sep-2012: http://mirrors.kernel.org/fedora/releases/18/Everything/x86_.... So that's 18 months of exposure for Fedora users (including me).

It's apparently Dec 2011 not Dec 2012, if we look at the date of the now famous commit:

http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=4817...

"Sat, 31 Dec 2011 22:59:57 +0000

Support for TLS/DTLS heartbeats. 20 files changed"

    > 2 years ago (Dec '12, which isn't even 2 years - but
    > anyway)

It was Dec 31 '11, not '12, that the commit was made--more than 2 years ago. It first appeared in the OpenSSL 1.0.1 release; March 14, 2012.

I don't know what's up with the timestamp on the Ubuntu announcement, but 12.04 was released in April 2012.

However, that's before the OpenSSL 1.0.1 date; the Ubuntu 12.04.4 update for openssl 1.0.1-2ubuntu1 came on March 22, 2012.

No matter how you slice it, that's more than 2 years.

Edit: Ubuntu 12.04 was April 2012, but the 12.04.4 point-release was released at the later date; that's where the 2014 date came from. 12.04 included OpenSSL 1.0.1 before that.

Reply on news.ycombinator.com