dmix on OpenSSL Security Advisory: TLS heartbeat read overrun

Comment on OpenSSL Security Advisory: TLS heartbeat read overrun

I had to google what "heartbeat extension" does:

   DTLS is designed to secure traffic running on top of unreliable
   transport protocols.  Usually such protocols have no session
   management.  The only mechanism available at the DTLS layer to figure
   out if a peer is still alive is performing a costly renegotiation.
   If the application uses unidirectional traffic there is no other way.

   TLS is based on reliable protocols but there is not necessarily a
   feature available to keep the connection alive without continuous
   data transfer.

   The Heartbeat Extension as described in this document overcomes these
   limitations.  The user can use the new HeartbeatRequest message which
   has to be answered by the peer with a HeartbeartResponse immediately.

https://tools.ietf.org/html/draft-ietf-tls-dtls-heartbeat-01

Edit: here is the commit patching the bug https://github.com/openssl/openssl/commit/7e840163c06c7692b7...

Comments