---
title: "Heartbleed OpenSSL Vulnerability (Indicative)"
description: "HawkScan test information for plugin 10034: Heartbleed OpenSSL Vulnerability (Indicative)"
url: https://docs.stackhawk.com/vulnerabilities/10034/
---

[Back to Index](https://docs.stackhawk.com/vulnerabilities/)

# Heartbleed OpenSSL Vulnerability (Indicative)

###### Reference

- **Plugin ID:** 10034
- [**CWE:** 119](https://cwe.mitre.org/data/definitions/119.html)
- **WASC:** 20
- **Risk:** Unknown
- **Type:** Passive
- **Category:** Vulnerable Components

### Remediation

1. **Update OpenSSL immediately**: Upgrade to OpenSSL 1.0.1g or later versions to patch the vulnerability.
2. **Reissue certificates**: Generate and deploy new SSL/TLS certificates as private keys may have been compromised.
3. **Change private keys**: Replace all asymmetric private keys and shared secret keys that may have been exposed.
4. **Monitor for indicators**: Check server logs for suspicious activity, though compromise may not be detectable.
5. **Notify users**: Consider informing users to change passwords as session data may have been compromised.

### About

Heartbleed is a critical OpenSSL vulnerability (CVE-2014-0160) affecting versions 1.0.1 through 1.0.1f. It allows attackers to read sensitive data from server memory including private keys, passwords, and other confidential information through malformed heartbeat requests.

### Risks

**Critical** Heartbleed enables attackers to steal private encryption keys, user credentials, sensitive data, and potentially decrypt past and future communications, representing one of the most severe SSL/TLS vulnerabilities discovered.