1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
|
---
title: 'Action required: Password reset on all Gentoo services'
active: false
type: information
created_at: 2014-04-13 08:30
affects: [bugzilla, forums, wiki, dgo_smtp, dgo_mbox]
---
Recent versions of OpenSSL were found to be affected by an information disclosure vulnerability related to TLS heartbeats, nicknamed [_Heartbleed_](http://heartbleed.com).
It allows attackers to read up to 64kb of random server memory, possibly including passwords, session IDs or even private keys.
Gentoo users should consult the related [GLSA](http://www.gentoo.org/security/en/glsa/glsa-201404-07.xml) for more information on how to address the issue on their machines.
After the public disclosure on April 7, we have confirmed that several services provided by Gentoo Infrastructure were vulnerable as well.
We have immediately updated the affected software, recreated private keys, reissued certificates, and invalidated all running user sessions.
Despite these measures, we cannot exclude the possibility of attackers exploiting the issue during the time it was not publicly known to gain access to credentials or session IDs of our users.
**There are currently no indications this has happened.**
However, to be safe, we are asking you to **reset your passwords used for Gentoo services within the next 7 days.**
#### Users & developers:
You need to take action if you have an account on one or more of these sites:
* blogs.gentoo.org
* bugs.gentoo.org
* forums.gentoo.org
* wiki.gentoo.org
Log in using your current credentials and use the reset password functionality:
* blogs.gentoo.org: https://blogs.gentoo.org/wp-admin/profile.php
* bugs.gentoo.org: https://bugs.gentoo.org/userprefs.cgi?tab=account
* forums.gentoo.org: https://forums.gentoo.org/profile.php?mode=editprofile
* wiki.gentoo.org: https://wiki.gentoo.org/index.php?title=Special:ChangePassword
#### Developers:
You need to change your LDAP password (used for `perl_ldap` and the [SMTP/IMAP/POP services](https://wiki.gentoo.org/wiki/Project:Infrastructure/Developer_E-Mail)).
To do that, log in to dev.gentoo.org via ssh and invoke `passwd`.
### Important:
If you don't update your credentials until **April 19, 23:59 UTC,** we will be **removing your current password** to avoid abuse.
For our web services, you will then need to request a reset via email.
**We can not recover your account in case your email address on file is not current.**
For LDAP accounts, developers will need to be in possession of their SSH or GPG keys and contact infra for a normal password reset.
### Further help:
Contact [infra-heartbleed@gentoo.org](mailto:infra-heartbleed@gentoo.org) for assistance or further information.
|
GitWeb
