OpenSSL
2 articles with this tag
What is OpenSSL — the library under HTTPS, and how to defend it
OpenSSL = the open-source library that powers HTTPS (TLS/SSL) and crypto. Most people never write it directly — they inherit it via the web server, OS, or language runtime. That's why one bug has an enormous blast radius (Heartbleed is the classic case). Defense: know which OpenSSL your stack uses, don't run EOL versions, include foundational libraries in CVE monitoring, and patch promptly. Even the certificates this site serves run crypto through an OpenSSL-family implementation underneath.
Heartbleed (CVE-2014-0160) — when memory leaked from the foundation of encrypted traffic
OpenSSL's memory over-read could leak private keys and sessions. The cause: the server trusted a claimed length and read adjacent memory. The lesson: act as if it all leaked — re-issue certificates, rotate all secrets — plus the weight of foundational software and memory safety.