From: Jeff Tancill <jeff.tancill_at_oracle.com>
Date: Thu, 10 Apr 2014 09:24:48 -0700 (PDT)
I'm trying to determine where GF uses openSSL if at all. The security modules, as Bill points out below, use JDK's SSL implementation (JSSE), not OpenSSL. It also appears that the Grizzly/web components do not use OpenSSL either. Checking with some other components to be sure but in any case I show we have version 0.9.8o associated with 3.1.1 through 4.0.0, so GlassFish should not be vulnerable to heartbleed issue.
Jeff
-----Original Message-----
From: forums_at_java.net [mailto:forums_at_java.net]
Sent: Thursday, April 10, 2014 4:28 AM
To: users_at_glassfish.java.net
Subject: Re: Does GlassFish 3 use OpenSSL for encryption? #heartbleed