<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">Hello everyone,<div><br></div><div>Please be aware that the recently disclosed vulnerability in openssl (CVE-2014-0160)[1] affected the Ubuntu Precise distribution of that library (which is in use in Labs). This vulnerability potentially exposes server process memory in a way that may allow an attacker to recover the private key during SSL negotiation.</div><div><br></div><div>We have forcibly upgraded that library on all instances (as well as the WMF infrastructure) and will replace any potentially exposed SSL key material; but please note that if you use SSL within your project, you should consider all keys to be compromised, generate new keys and issue new certificates.</div><div><br></div><div>(To be clear, this does not affect SSH key material in any way).</div><div><br></div><div>— Marc</div><div><br></div><div>[1] <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160</a></div></body></html>