Exploited in the wild · OpenSSL · CVSS 7.5 · published 7 April 2014
Heartbleed: CVE-2014-0160
A missing bounds check in OpenSSL's TLS heartbeat extension that lets anyone read up to 64 KB of server memory at a time, including private keys and passwords. Below is its status on each Linux distribution past end of life, from the vendors' own security trackers.
- 0end-of-life systems without a free fix
- 9fixed or not affected
Heartbleed on end-of-life Linux
| Distribution | Status | Details |
|---|---|---|
| CentOS 6 | Fixed | openssl 1.0.1e-16.el6_5.7, 8 April 2014 |
| CentOS 7 | Not affected | Red Hat security data |
| RHEL 7 | Not affected | Red Hat security data |
| CentOS 8 | Fixed before release | published before RHEL 8 shipped |
| Ubuntu 16.04 | Fixed before release | published before this release shipped |
| Ubuntu 18.04 | Fixed before release | published before this release shipped |
| Ubuntu 20.04 | Fixed before release | published before this release shipped |
| Debian 10 | Fixed before release | published before this release shipped |
| Debian 11 | Fixed before release | published before this release shipped |
From the Red Hat security data (CentOS and RHEL), the Ubuntu CVE tracker and the Debian security tracker, 29 October 2026. CentOS received Red Hat's fixes only until its own end of life; later fixes went to paid Red Hat support. Fixes marked Ubuntu Pro need a paid subscription. Where a tracker has no entry, the version in the distribution's repository is checked against the NVD range.
The OpenSSL versions we track
| Version | CVE-2014-0160 |
|---|---|
| OpenSSL 1.0.1e | Affected |
| OpenSSL 1.0.2g | Not affected |
| OpenSSL 1.0.2k | Not affected |
| OpenSSL 1.0.2u | Not affected |
| OpenSSL 1.1.1 | Not affected |
| OpenSSL 1.1.1f | Not affected |
| OpenSSL 1.1.1k | Not affected |
| OpenSSL 1.1.1n | Not affected |
| OpenSSL 1.1.1w | Not affected |
| OpenSSL 3.0.22 | Not affected |
For the upstream version, according to the US National Vulnerability Database. A distribution package may carry its own fix; the table above shows that.
What the NVD record says
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.
Score 7.5 (High), published 7 April 2014. Listed in the CISA catalogue of known exploited vulnerabilities on 4 May 2022. Read the NVD entry
Affected upstream versions of OpenSSL
- openssl from 1.0.1 before 1.0.1g
What you can do
Keep OpenSSL, patched
Where the table shows no free fix, we backport it to the package you run, built and tested before delivery. A fix for a new vulnerability arrives within 48 hours of your order, or within 24 hours with priority delivery.
Upgrade
Move to a supported release once your applications can make the jump. Our fixes keep you safe while you plan it.
Assess first
Our assessment shows which vulnerabilities are real on your servers, what else is past end of life, and the remediation plan.