It is hard to say exactly which apps/services are affected. This is because OpenSSL is a collection of programming code (referred to as a "library") that can be used to add TLS support to an application or system. TLS (Transport Layer Security) provides secure connections, and is best known as the security layer behind HTTPS websites.
So if a programmer were writing a program that needed to use TLS to connect to something, they can use the OpenSSL library to add that ability to their app.
The OpenSSL library itself is constantly being improved, like many other bits of software. During this process, the Heartbleed bug was accidentally introduced, affecting OpenSSL versions 1.0.1 through 1.0.1f (inclusive). 1.0.1 was released on 14th of March 2012 and 1.0.1g (which fixes the bug) was released on 7th of April 2014 .
This means that any application that uses those OpenSSL versions for TLS is potentially affected. No doubt any affected developers have fixes in progress.
The fix has since been "backported", meaning that it has been added to versions of OpenSSL prior to 1.0.1g. This is a good thing, and is very common, but has the side effect of making it harder to tell if an app is vulnerable (since one can't just query the OpenSSL version to check).
To address your specific questions:
- SSH is not affected (SSH is a different protocol to TLS)
- HTTP is not affected (HTTP is also a different protocol to TLS), meaning that a HTTP-only server will not be affected.
- Note that it's possible to provide HTTPS using other libraries - so Microsoft IIS Web Servers (which don't use OpenSSL) can provide HTTPS without being affected.