What versions (if any) of JBoss are affected by the Heartbleed vulnerability?

Question

Anyone know the best way to determine whether my JBoss application is vulnerable to the heartbleed security bug?

I am using JBoss versions 4.0.4 and 5.1.0.

Answer 1

A good explanation is on the security StackExchange site. The answer linked is specific to Tomcat, but applicable to JBoss (or other Java applications) as well. The short answer is no, because Java implements its own stack of SSL/TLS and does not relay on the OpenSSL or any other SSL implementation library.

Tomcat is written in Java, and Java has its own allocation system (the famous garbage collector) which obtains memory from the OS by huge blocks, quite apart from the zones where OpenSSL obtains its blocks.

Thus, the heartbleed buffer overrun is unlikely to reveal any secret information which exists as Java-based object. It may, however, obtain information which is allocated from the same heap as where OpenSSL obtains its own buffers. In particular, it is possible that the vulnerability may reveal part or all of the private key used by OpenSSL itself.