Security Alert: OpenSSL vulnerability

ACDC

Does this effect the ssl security setup in Tomcat, if it does then it is very serious for an AIM installation - more info here http://heartbleed.com/

aware_support

Aware IM (or Tomcat) do not use this library.

RLJB

But.. what if you use OpenSSL to generate your keys for your SSL cert, would that not create a vulnerability on an AwareIM system?

aware_support

Don't know. This is done outside of Aware IM - has nothing to do with it.

RLJB

ACDC - if you use https (SSL certificate) and you used OpenSSL to generate keys for your SSL certificate then you should check your server, as you may be vulnerable to Heartbleed, it will depend on the version of OpenSSL that was used.

Detection and updating to a new version is quick and relatively painless. You can also test for Heartbleed vulnerability here: https://www.ssllabs.com/ssltest/

While it has nothing to do with the Aware software, if you are running a SSL Certificate (which really every Aware production install should do) then it will affect your Aware installation and your Aware users.

ACDC

If I am not mistaken the Tomcat install that comes with awareim for windows uses OpenSSL, I was trying to confirm that in my original post .

ACDC

but according to support is does not

kklosson

And thank you RLJB for the link. I ran the check on my site and it confirmed that I have no vulnerabilities. Using Entrust Extended Validate Cert.