6 ms·
Apparently there is a Security Bulletins page, but I wasn't aware of it until you posted this link. https://aws.amazon.com/security/security-bulletins/ https://
by mmelin 12y ago
Apparently there is a Security Bulletins page, but I wasn't aware of it until you posted this link. https://aws.amazon.com/security/security-bulletins/ https://aws.amazon.com/security/security-bulletins/
Just used Zapier to set up a RSS-to-email trigger to get notified about things like this in the future, although Amazon really should be sending them out automatically to customers.
- lox 12y agoGreat idea, I just setup an RSS-to-slack trigger for future notifications: http://zpr.io/HSkn http://zpr.io/HSkn
- raveli 12y agoShould anyone else find it useful, here's what I'm now using: http://zpr.io/HS5f http://zpr.io/HS5f It detects new AWS security bulletin items and notifies you via Google Hangout.
- tlogan 12y agoGreat! ./heartbleeder zapier.com VULNERABLE - zapier.com:443 has the heartbeat extension enabled and is vulnerable to CVE-2014-0160
- bryanh 12y agoAWS's ELB (which we use) were vulnerable, we'll be replacing certificates ASAP. We (and most the rest of the internet using ELB) seem to be in the clear now: ./heartbleeder zapier.com SECURE - zapier.com:443 has the heartbeat extension enabled, but timed out after a malformed heartbeat (this likely means that it is not vulnerable) When did you run your check? Do you have a recent binary of heartbleeder?
- nicwolff 12y agoThat'd be great, except the last thing in the RSS feed at feed://aws.amazon.com/rss/security.rss is almost a year old ಠ_ಠ