Mailing-List: contact users-help@camel.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@camel.apache.org
Received-SPF: pass (nike.apache.org: domain of richardkettelerij@gmail.com
 designates 209.85.220.179 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <1397066027541-5750006.post@n5.nabble.com>
References: <1397066027541-5750006.post@n5.nabble.com>
From: Richard Kettelerij <richardkettelerij@gmail.com>
Date: Wed, 9 Apr 2014 21:04:11 +0200
Message-ID: 
 <CAE+mP=ohNEcDk7gAWAk32TkBYvFJ8tyjQe68nGDgJdi67Mn8Qg@mail.gmail.com>
Subject: Re: Is Camel affected by the OpenSSL heart bleed bug?
To: "users@camel.apache.org" <users@camel.apache.org>
Content-Type: multipart/alternative; boundary=001a11362cd44aa5a504f6a0c5d7

--001a11362cd44aa5a504f6a0c5d7
Content-Type: text/plain; charset=UTF-8

Camel, CXF, Karaf are all written in Java and Java has its own crypto/SSL
implementation. There's no dependency on OpenSSL in any of those
applications/frameworks.

Of course if you're running Camel/CXF/Karaf on a server that does use
OpenSSL for something else (let's say you're running Camel or CXF behind
Apache HTTPd with mod_ssl) then you may be affected by this vulnerability
since mod_ssl does use OpenSSL. But Camel, CXF, Karaf and ActiveMQ itself
don't use OpenSSL.

Kind regards,
Richard Kettelerij
http://richardlog.com


On Wed, Apr 9, 2014 at 7:53 PM, bocamel <johnzyin@gmail.com> wrote:

> We are using Camel (with CXF and Karaf).  Does anyone know if we should be
> concerned with this new OpenSSL security bug?
>
> Thanks!
>
>
>
> --
> View this message in context:
> http://camel.465427.n5.nabble.com/Is-Camel-affected-by-the-OpenSSL-heart-bleed-bug-tp5750006.html
> Sent from the Camel - Users mailing list archive at Nabble.com.
>

--001a11362cd44aa5a504f6a0c5d7--