Originally Posted by fstern

More infos: http://heartbleed.com/

What is leaked primary key material and how to recover?

These are the crown jewels, the encryption keys themselves. Leaked secret keys allows the attacker to decrypt any past and future traffic to the protected services and to impersonate the service at will. Any protection given by the encryption and the signatures in the X.509 certificates can be bypassed. Recovery from this leak requires patching the vulnerability, revocation of the compromised keys and reissuing and redistributing new keys. Even doing all this will still leave any traffic intercepted by the attacker in the past still vulnerable to decryption. All this has to be done by the owners of the services.

Originally Posted by fstern

openssl has been upgraded. Sorry for the inconvenience.

Originally Posted by lma

(emphasis mine). Though I understand StartSSL are being somewhat less than helpful :-(

I will issue new certificates next week as our StartSSL certificates expire.


Were the services restarted? Tests like http://filippo.io/Heartbleed/ and http://possible.lv/tools/hb/ currently report {wiki,bugs,lists}.maemo.org as vulnerable.