CyberGlossary

Vulnerabilities

Heartbleed (CVE-2014-0160)

Also known as: CVE-2014-0160, OpenSSL heartbeat bug

Definition

A 2014 buffer over-read in OpenSSL's TLS heartbeat extension that let attackers read up to 64 KB of process memory per request, leaking keys, sessions, and passwords.

Disclosed in April 2014, Heartbleed (CVE-2014-0160) is a missing bounds check in OpenSSL versions 1.0.1 through 1.0.1f when processing TLS heartbeat messages. By sending a heartbeat request claiming a larger payload than supplied, an attacker tricked the server into echoing back the requested length of adjacent memory — repeatedly, undetectably, over plain TLS. Stolen contents commonly included private RSA keys, session cookies, credentials, and email contents from web servers, VPN gateways and embedded devices. The impact triggered mass patching, key rotation and certificate revocation worldwide. The fix is OpenSSL 1.0.1g or later, with operators replacing keys and invalidating sessions to assume compromise.

Examples

  • Attackers retrieving the TLS private key of a popular SaaS to decrypt captured traffic.
  • Mass scraping of session cookies from authenticated users of vulnerable servers.

Related terms