OpenSSL

The 2014 Heartbleed vulnerability was a serious flaw in the OpenSSL cryptography library that had existed for over two years and affected approximately 17% of secure web servers worldwide.

The Heartbleed vulnerability incident directly gave rise to the Linux Foundation's Core Infrastructure Initiative (now OpenSSF).

The 2014 Heartbleed vulnerability (CVE-2014-0160) originated from a buffer over-read error in OpenSSL's TLS heartbeat extension implementation, allowing attackers to read up to 64 KB of server memory per request.

The Heartbleed vulnerability existed in the OpenSSL codebase for more than two years before being discovered, directly leading to the establishment of the Core Infrastructure Initiative (CII, later evolved into OpenSSF).

The 2014 Heartbleed vulnerability in OpenSSL exposed the dire funding situation of core open-source maintainers

The Heartbleed vulnerability lay dormant in the OpenSSL codebase for approximately two years, while the GHOST vulnerability (CVE-2015-0235) in glibc lay dormant for approximately 14 years.

Before the Heartbleed vulnerability was disclosed in 2014, OpenSSL had only one core maintainer, and annual donations were less than two thousand dollars.

If Git is linked against OpenSSL and its CA bundle is not refreshed with system updates, the phenomenon of "revoked by the system but still trusted by Git" occurs.

Git itself does not implement TLS but delegates to an underlying TLS library (such as Secure Transport, OpenSSL, or LibreSSL).

OpenSSL typically reads a PEM-format CA bundle file, such as /etc/ssl/cert.pem or the ca-bundle.crt bundled with Git.

The supply chain risk of open-source infrastructure lies in the fact that core components such as PHP, OpenSSL, and Log4j are indirectly depended on by countless downstream projects, so a single vulnerability can rapidly amplify along the dependency chain.

System-level trust stores (such as ca-certificates.crt or cert.pem) do not automatically sync browsers' certificate revocation updates, and a large number of tools including curl, git, Python, Perl, Ruby and OpenSSL rely on this file.

Open-source public infrastructure refers to open-source projects that are widely relied upon but are often maintained by a small number of volunteers or a small team, such as OpenSSL, cURL, log4j, and others.

OpenSSL 3.2+ and BoringSSL already provide related support for hybrid key exchange.

The signing step requires developers to apply for a dedicated certificate in the Apple Developer portal and complete the process using tools such as OpenSSL.

Critical infrastructure such as Linux and OpenSSL has built trust through open scrutiny.

The Heartbleed vulnerability in OpenSSL and the Log4Shell vulnerability in Log4j exposed systemic issues of insufficient maintenance resources for critical open-source projects.

When the Heartbleed vulnerability was disclosed, the OpenSSL project had only one core full-time maintainer, Stephen Henson, and the project's annual donation revenue was less than $2,000.