If I understand correctly the hearbleed vulnerability, only the heap of the OpenSSL process can be retrieved by an attacker (or part of depending on the memory allocation type that is used). Then, how comes the OpenSSL process keeps in memory what it has encrypted/decrypted previously ?
It seems obvious that given the sensitivity of the OpenSSL process, there should not be any data kept in memory for longer that what's strictly needed, something like a "need to know" principle to ensure that the impact is kept at a reasonable level if the process is compromised.
I understand this sensitive data has to be put in memory to be communicated to the above layer/service (e.g. http server in most cases), but once it has been transmited it should be immediately removed, right ?