No "Heartbleed" for DNN

The "Heartbleed" security issue has received a significant amount of attention recently. This is a serious security issue which affects users of OpenSSL. We've received a few emails from user's asking if DNN is potentially effected, so we thought that a quick blog was in order.

DNN runs on Microsoft's asp.net platform, and is hosted by Microsoft's Internet Information Server.  Microsoft has confirmed that default configurations of Windows do not include OpenSSL, and are not impacted by this vulnerability.   Windows comes with its own encryption component called Secure Channel (a.k.a. SChannel), which is not susceptible to the Heartbleed vulnerability.

You can read more details about this here along with confirmation that Microsoft's Azure platform is also secure here

Whilst DNN itself is not affected, we recommend that all users consider changing their passwords on websites that they visit that use SSL e.g. banking sites, email, commerce sites etc. You can use utilities such as this to check if a site was affected - there's also a useful list of popularly affected sites here