This question already has an answer here:

It is public that Amazon's Elastic Load Balancers (ELBs) were vulnerable to the heartbleed exploit before they patched them all on April 8th. I understand that the memory of these ELBs (and therefore the certificates on them) could be compromised, but I'm curious if there was any risk of memory exposure of the EC2 instances behind these ELBs (given that the EC2 instances were not themselves vulnerable, nor accessible from external IP addresses).

marked as duplicate by AviD Apr 10 '14 at 13:58

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.



The heartbleed-bug only compromises the memory of the operating system process which uses OpenSSL. The memory of any other processes is not compromised. When load-balancer and application server are different processes AND the load-balancer acts as TLS server (instead of just routing the raw data-stream to the application server which then does the TLS), the memory of the application server can not be compromised.

Not the answer you're looking for? Browse other questions tagged or ask your own question.