April 18, 2014, OpenSSL Heartbeat bug

Our server hosting the Trac issue tracker was vulnerable to the attack against OpenSSL known as "heartbleed". The OpenSSL software library was updated on 7th of April, shortly after the vulnerability was publicly disclosed. We have changed the private keys (and certificates) for all FFmpeg servers. The details were sent to the mailing lists by Alexander Strasser, who is part of the project server team. Here is a link to the user mailing list archive .

We encourage you to read up on "OpenSSL heartbleed". It is possible that login data for the issue tracker was exposed to people exploiting this security hole. You might want to change your password in the tracker and everywhere else you used that same password.