# Security issue on the ReactOS infrastructure

DevFeed: [Security issue on the ReactOS infrastructure](<https://devfeed.tech/articles/security-issue-on-the-reactos-infrastructure-33234.md>)

Original publisher: [Read original article](<https://reactos.org/project-news/security-issue-reactos-infrastructure-2014/>)

Published: 2014-04-09T00:00:00Z

Content type: news

Language: en

Sources: [Front Page on ReactOS Website](<https://devfeed.tech/sources/front-page-on-reactos-website.md>)

Topics: [ReactOS](<https://devfeed.tech/topics/reactos.md>), [Security](<https://devfeed.tech/topics/security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [openssl](<https://devfeed.tech/topics/openssl.md>), [SSL](<https://devfeed.tech/topics/ssl.md>), [TLS (Transport Layer Security)](<https://devfeed.tech/topics/tls.md>)

Tags: [cve](<https://devfeed.tech/tags/cve.md>), [free](<https://devfeed.tech/tags/free.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [openssl](<https://devfeed.tech/tags/openssl.md>), [os](<https://devfeed.tech/tags/os.md>), [react](<https://devfeed.tech/tags/react.md>), [reactos](<https://devfeed.tech/tags/reactos.md>), [release](<https://devfeed.tech/tags/release.md>), [security](<https://devfeed.tech/tags/security.md>), [ssl](<https://devfeed.tech/tags/ssl.md>), [tls](<https://devfeed.tech/tags/tls.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [win32](<https://devfeed.tech/tags/win32.md>), [winapi](<https://devfeed.tech/tags/winapi.md>)

## AI overview

ReactOS reports that its infrastructure was affected by the Heartbleed vulnerability in OpenSSL. The project applied the fix, renewed its SSL certificates and private keys, and warned that account information and sessions might have been compromised. Users were advised to change their passwords and review their accounts.

## Source excerpt

Dear all, In case you don't use SSL/TLS on our infrastructure (web sites - drupal, jira, fisheye), skip reading (and reconsider your choices about such non-usage). As you may (should?) have heard recently, OpenSSL has suffered a critical security vulnerability (CVE-2014-0160), known as Heartbleed Bug (http://heartbleed.com/). Most of our services were using an affected release of OpenSSL, with heartbeat feature activated. Be it, mails services, web services (Drupal, Jira).