CVE-2015-0235 "Ghost"

Apps 31 hours, 46 minutes
Tools 31 hours, 46 minutes

Activity

  • Resolved

    At 8am (PST) yesterday (Jan 27th), Ubuntu and other vendors disclosed a vulnerability (CVE-2015-0235) in the gethostbyname functions in libc which allows an attacker to execute remote code via lookups executed on a specially-crafted hostname. You can find more details about this vulnerability, known as "Ghost", in this excellent write-up by Qualys.

    Over the last day our engineers have remediated this issue. Updated stack images for our cedar stack were released yesterday, and will propagate to your dynos within the next 24 hours. If you want to quickly guarantee that your dynos have updated, restarting your dynos (ps:restart) will ensure that the new image is picked up. If you're running the cedar-14 image, your applications were never vulnerable; this issue only affected our cedar image.

    As part of our ongoing defense in depth work we expect additional maintenance windows over the coming weeks for a number of services, including Heroku Postgres.

    Posted 10 years ago, Jan 28, 2015 23:46 UTC

  • Retroactive

    This incident is being resolved retroactively. Refer to the resolved text for a full statement.

    Posted 10 years ago, Jan 27, 2015 16:00 UTC

Current status