Samepage released a patch to protect against the OpenSSL vulnerability on April 8, 2014. Kerio advises all of its customers to change their passwords and revoke SSL certificates.
On Monday, April 7, 2014 a security engineer at Google and a team of researchers at Finnish security company Codenomicon Ltd. uncovered a serious vulnerability in OpenSSL. The vulnerability is now known as Heartbleed. OpenSSL encrypts communication between your computer and the server and is built into Apache web server used by about two-thirds of websites globally. OpenSSL is also used by tens of thousands of IT vendors including Kerio to provide secure connections.
We have taken the following precautions to safeguard the Samepage servers and service:
- We have updated our OpenSSL software which patches the vulnerability caused by the Heartbleed bug
- We have revoked and reissued new SSL security certificates for the Samepage service