OpenSSL
An open-source cryptographic library underpinning HTTPS encryption globally. In 2014, the Heartbleed vulnerability exposed the chronic underfunding of open-source security infrastructure.
Core Facts
The 2014 Heartbleed vulnerability was a serious flaw in the OpenSSL cryptography library that had existed for over two years and affected approximately 17% of secure web servers worldwide.
The Heartbleed vulnerability incident directly gave rise to the Linux Foundation's Core Infrastructure Initiative (now OpenSSF).
The 2014 Heartbleed vulnerability (CVE-2014-0160) originated from a buffer over-read error in OpenSSL's TLS heartbeat extension implementation, allowing attackers to read up to 64 KB of server memory per request.
Timeline (last 90 days)
Open-source public infrastructure refers to open-source projects that are widely relied upon but are often maintained by a small number of volunteers or a small team, such as OpenSSL, cURL, log4j, and others.
OpenSSL 3.2+ and BoringSSL already provide related support for hybrid key exchange.
The signing step requires developers to apply for a dedicated certificate in the Apple Developer portal and complete the process using tools such as OpenSSL.
Critical infrastructure such as Linux and OpenSSL has built trust through open scrutiny.
The Heartbleed vulnerability in OpenSSL and the Log4Shell vulnerability in Log4j exposed systemic issues of insufficient maintenance resources for critical open-source projects.
When the Heartbleed vulnerability was disclosed, the OpenSSL project had only one core full-time maintainer, Stephen Henson, and the project's annual donation revenue was less than $2,000.
The Heartbleed vulnerability existed in the OpenSSL codebase for more than two years before being discovered, directly leading to the establishment of the Core Infrastructure Initiative (CII, later evolved into OpenSSF).
The 2014 Heartbleed vulnerability (CVE-2014-0160) originated from a buffer over-read error in OpenSSL's TLS heartbeat extension implementation, allowing attackers to read up to 64 KB of server memory per request.
The 2014 Heartbleed vulnerability in OpenSSL exposed the dire funding situation of core open-source maintainers
All Facts (13)
The 2014 Heartbleed vulnerability was a serious flaw in the OpenSSL cryptography library that had existed for over two years and affected approximately 17% of secure web servers worldwide.
90%VerifiedThe Heartbleed vulnerability incident directly gave rise to the Linux Foundation's Core Infrastructure Initiative (now OpenSSF).
70%VerifiedThe 2014 Heartbleed vulnerability (CVE-2014-0160) originated from a buffer over-read error in OpenSSL's TLS heartbeat extension implementation, allowing attackers to read up to 64 KB of server memory per request.
65%VerifiedThe Heartbleed vulnerability existed in the OpenSSL codebase for more than two years before being discovered, directly leading to the establishment of the Core Infrastructure Initiative (CII, later evolved into OpenSSF).
65%UnverifiedThe 2014 Heartbleed vulnerability in OpenSSL exposed the dire funding situation of core open-source maintainers
85%UnverifiedBefore the Heartbleed vulnerability was disclosed in 2014, OpenSSL had only one core maintainer, and annual donations were less than two thousand dollars.
60%UnverifiedOpen-source public infrastructure refers to open-source projects that are widely relied upon but are often maintained by a small number of volunteers or a small team, such as OpenSSL, cURL, log4j, and others.
50%UnverifiedOpenSSL 3.2+ and BoringSSL already provide related support for hybrid key exchange.
50%UnverifiedThe signing step requires developers to apply for a dedicated certificate in the Apple Developer portal and complete the process using tools such as OpenSSL.
50%UnverifiedCritical infrastructure such as Linux and OpenSSL has built trust through open scrutiny.
50%UnverifiedThe Heartbleed vulnerability in OpenSSL and the Log4Shell vulnerability in Log4j exposed systemic issues of insufficient maintenance resources for critical open-source projects.
50%UnverifiedWhen the Heartbleed vulnerability was disclosed, the OpenSSL project had only one core full-time maintainer, Stephen Henson, and the project's annual donation revenue was less than $2,000.
50%UnverifiedHeartbleed漏洞在OpenSSL代码库中潜伏约两年，glibc的GHOST漏洞(CVE-2015-0235)潜伏约14年
50%