Does the Heartbleed vulnerability affect the Qvera Interface Engine?

Question

With the recent publicity about the Heartbleed vunerability with OpenSSL, many folks are wondering if that affects the Qvera Interface Engine at all.  Does it?

Answer 1

QIE is NOT affected by the Heartbleed OpenSSL vulnerability.

The Heartbleed vulnerability is only found in certain versions of the OpenSSL library.  For outgoing SSL connections, QIE uses the native Java crypto libraries and, in some cases, the bouncycastle crypto libraries.  Consequently, the Heartbleed OpenSSL vulnerability has no affect on the Qvera Interface Engine.

However, if you have configured the Apache HTTP Server to accommodate incoming HTTPS connections (see https://www.qvera.com/kb/index.php/393/does-qvera-accept-an-https-request ) then you may need to double check your Apache configuration.  To check the version of OpenSSL installed with Apache HTTP Server just run `openssl version` from the command line.  If the version is before 2012, then the system is not effected by the bug.  If it is after 2012, then you will need the OpenSSL fix.