OpenSSL
支撑全球HTTPS加密的开源基础库，2014年因Heartbleed漏洞暴露开源安全基础设施资金匮乏问题
Core Facts
The 2014 Heartbleed vulnerability was a serious flaw in the OpenSSL cryptography library that had existed for over two years and affected approximately 17% of secure web servers worldwide.
The Heartbleed vulnerability incident directly gave rise to the Linux Foundation's Core Infrastructure Initiative (now OpenSSF).
The 2014 Heartbleed vulnerability (CVE-2014-0160) originated from a buffer over-read error in OpenSSL's TLS heartbeat extension implementation, allowing attackers to read up to 64 KB of server memory per request.
Timeline (last 90 days)
OpenSSL 3.2+ and BoringSSL already provide related support for hybrid key exchange.
The signing step requires developers to apply for a dedicated certificate in the Apple Developer portal and complete the process using tools such as OpenSSL.
Critical infrastructure such as Linux and OpenSSL has built trust through open scrutiny.
The Heartbleed vulnerability in OpenSSL and the Log4Shell vulnerability in Log4j exposed systemic issues of insufficient maintenance resources for critical open-source projects.
When the Heartbleed vulnerability was disclosed, the OpenSSL project had only one core full-time maintainer, Stephen Henson, and the project's annual donation revenue was less than $2,000.
The Heartbleed vulnerability existed in the OpenSSL codebase for more than two years before being discovered, directly leading to the establishment of the Core Infrastructure Initiative (CII, later evolved into OpenSSF).
The 2014 Heartbleed vulnerability (CVE-2014-0160) originated from a buffer over-read error in OpenSSL's TLS heartbeat extension implementation, allowing attackers to read up to 64 KB of server memory per request.
The 2014 Heartbleed vulnerability in OpenSSL exposed the dire funding situation of core open-source maintainers
Before the Heartbleed vulnerability was disclosed in 2014, OpenSSL had only one core maintainer, and annual donations were less than two thousand dollars.
The Heartbleed vulnerability incident directly gave rise to the Linux Foundation's Core Infrastructure Initiative (now OpenSSF).
All Facts (12)
The 2014 Heartbleed vulnerability was a serious flaw in the OpenSSL cryptography library that had existed for over two years and affected approximately 17% of secure web servers worldwide.
90%VerifiedThe Heartbleed vulnerability incident directly gave rise to the Linux Foundation's Core Infrastructure Initiative (now OpenSSF).
70%VerifiedThe 2014 Heartbleed vulnerability (CVE-2014-0160) originated from a buffer over-read error in OpenSSL's TLS heartbeat extension implementation, allowing attackers to read up to 64 KB of server memory per request.
65%VerifiedThe Heartbleed vulnerability existed in the OpenSSL codebase for more than two years before being discovered, directly leading to the establishment of the Core Infrastructure Initiative (CII, later evolved into OpenSSF).
65%UnverifiedThe 2014 Heartbleed vulnerability in OpenSSL exposed the dire funding situation of core open-source maintainers
85%UnverifiedBefore the Heartbleed vulnerability was disclosed in 2014, OpenSSL had only one core maintainer, and annual donations were less than two thousand dollars.
60%UnverifiedOpenSSL 3.2+ and BoringSSL already provide related support for hybrid key exchange.
50%UnverifiedThe signing step requires developers to apply for a dedicated certificate in the Apple Developer portal and complete the process using tools such as OpenSSL.
50%UnverifiedCritical infrastructure such as Linux and OpenSSL has built trust through open scrutiny.
50%UnverifiedThe Heartbleed vulnerability in OpenSSL and the Log4Shell vulnerability in Log4j exposed systemic issues of insufficient maintenance resources for critical open-source projects.
50%UnverifiedWhen the Heartbleed vulnerability was disclosed, the OpenSSL project had only one core full-time maintainer, Stephen Henson, and the project's annual donation revenue was less than $2,000.
50%UnverifiedHeartbleed漏洞在OpenSSL代码库中潜伏约两年，glibc的GHOST漏洞(CVE-2015-0235)潜伏约14年
50%