{"id":23851,"date":"2026-09-16T09:57:52","date_gmt":"2026-09-16T09:57:52","guid":{"rendered":"https:\/\/www.mailgun.com\/blog\/mailgun-and-heartbleed-2\/"},"modified":"2026-09-16T09:57:52","modified_gmt":"2026-09-16T09:57:52","slug":"mailgun-and-heartbleed","status":"publish","type":"blog","link":"https:\/\/www.mailgun.com\/fr\/blog\/product\/mailgun-and-heartbleed\/","title":{"rendered":"Mailgun et Heartbleed"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>Cet incident a \u00e9t\u00e9 signal\u00e9 le 10 avril 2014.<\/strong><\/p>\n\n\n\r\n    <nav data-content-type=\"longform\" class=\"toc-block longform-spacings px-5 py-6 px-md-6 px-lg-7 py-md-7 bg-light fs-sm rounded-lg\" aria-labelledby=\"toc-title-5556\"><p class=\"h5 m-0\" id=\"toc-title-5556\">Table des mati\u00e8res<\/p><div class=\"d-flex mt-3\"><div class=\"w-auto fw-bold text-accent d-flex me-2\">01<\/div><div class=\"d-flex flex-column\"><a class=\"fw-bold scrollme link-body-color text-accent\" href=\"#heartbleed\">Heartbleed<\/a><\/div><\/div><div class=\"d-flex mt-3\"><div class=\"w-auto fw-bold text-accent d-flex me-2\">02<\/div><div class=\"d-flex flex-column\"><a class=\"fw-bold scrollme link-body-color text-accent\" href=\"#attenuation\">Att\u00e9nuation<\/a><\/div><\/div><div class=\"d-flex mt-3\"><div class=\"w-auto fw-bold text-accent d-flex me-2\">03<\/div><div class=\"d-flex flex-column\"><a class=\"fw-bold scrollme link-body-color text-accent\" href=\"#impact-sur-les-clients\">Impact sur les clients<\/a><\/div><\/div><\/nav>\n\n\n<h2 class=\"wp-block-heading\">Heartbleed<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Plus t\u00f4t cette semaine, nous avons \u00e9t\u00e9 alert\u00e9s d&rsquo;une vuln\u00e9rabilit\u00e9 de s\u00e9curit\u00e9 dans OpenSSL [<a href=\"http:\/\/heartbleed.com\/\" target=\"_tabs\" rel=\"noopener noreferrer\">1<\/a>] [<a href=\"https:\/\/news.ycombinator.com\/item?id=7548991\" target=\"_tabs\" rel=\"noopener noreferrer\">2<\/a>]. M\u00eame si cette vuln\u00e9rabilit\u00e9 ne se trouvait pas dans le code de Mailgun, Mailgun utilise la biblioth\u00e8que OpenSSL pour s\u00e9curiser les connexions HTTPS vers nos serveurs. Nous y \u00e9tions donc \u00e9galement expos\u00e9s. Dans le jargon de la s\u00e9curit\u00e9, Heartbleed \u00e9tait une vuln\u00e9rabilit\u00e9 de lecture arbitraire permettant \u00e0 l&rsquo;attaquant de lire 64\u00a0ko de m\u00e9moire dans l&rsquo;espace m\u00e9moire des processus affect\u00e9s. Ce qui rendait ce bug particuli\u00e8rement tra\u00eetre, c&rsquo;est qu&rsquo;il ne laissait aucune trace et permettait \u00e0 l&rsquo;attaquant d&rsquo;acc\u00e9der aux cl\u00e9s priv\u00e9es, neutralisant ainsi le m\u00e9canisme de s\u00e9curit\u00e9 TLS.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Att\u00e9nuation<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Une fois que nous avons pris connaissance de Heartbleed, nous avons analys\u00e9 o\u00f9 notre infrastructure \u00e9tait vuln\u00e9rable et avons appliqu\u00e9 un correctif sur les serveurs affect\u00e9s. L&rsquo;architecture de Mailgun nous permet de terminer toutes les connexions SSL\/TLS lorsqu&rsquo;elles entrent dans notre centre de donn\u00e9es\u00a0; ainsi, nous n&rsquo;avions que quelques serveurs sur lesquels appliquer un correctif. Ce travail a \u00e9t\u00e9 achev\u00e9 le mardi 8 avril 2014 \u00e0 22\u00a0h\u00a0CET (13\u00a0h\u00a0PDT).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Une fois le correctif d\u00e9ploy\u00e9, nous avons \u00e9galement mis \u00e0 jour nos certificats pour garantir que, m\u00eame si nos cl\u00e9s priv\u00e9es avaient \u00e9t\u00e9 vol\u00e9es, elles ne pourraient plus \u00eatre utilis\u00e9es.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Si vous souhaitez le v\u00e9rifier par vous-m\u00eame, vous pouvez compiler et ex\u00e9cuter un script appel\u00e9 Heartbleed ou utiliser leur application web pour v\u00e9rifier la s\u00e9curit\u00e9 de Mailgun ou de tout autre site par rapport \u00e0 la vuln\u00e9rabilit\u00e9 Heartbleed [<a href=\"https:\/\/github.com\/FiloSottile\/Heartbleed\/\" target=\"_tabs\" rel=\"noopener noreferrer\">3<\/a>] [<a href=\"http:\/\/filippo.io\/Heartbleed\/\" target=\"_tabs\" rel=\"noopener noreferrer\">4<\/a>].<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Impact sur les clients<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u00c9tant donn\u00e9 que cette vuln\u00e9rabilit\u00e9 ne laisse aucune trace et a permis \u00e0 l&rsquo;attaquant de lire de mani\u00e8re arbitraire la m\u00e9moire de nos processus nginx, votre cl\u00e9 API et vos identifiants SMTP pourraient avoir \u00e9t\u00e9 compromis. Bien que la probabilit\u00e9 qu&rsquo;une telle attaque se soit produite soit faible, nous recommandons \u00e0 tous les clients de r\u00e9g\u00e9n\u00e9rer leur cl\u00e9 API et leurs identifiants SMTP (vous pouvez le faire depuis le panneau de contr\u00f4le) par mesure de s\u00e9curit\u00e9.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Si vous avez d&rsquo;autres questions, n&rsquo;h\u00e9sitez pas \u00e0 nous envoyer un email \u00e0 l&rsquo;adresse\u00a0<a href=\"mailto:support@mailgun.com\" target=\"_tabs\" rel=\"noopener noreferrer\">support@mailgun.com<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">[1]\u00a0<a href=\"http:\/\/heartbleed.com\/\" target=\"_tabs\" rel=\"noopener noreferrer\">http:\/\/heartbleed.com<\/a><br>[2]\u00a0<a href=\"https:\/\/news.ycombinator.com\/item?id=7548991\" target=\"_tabs\" rel=\"noopener noreferrer\">https:\/\/news.ycombinator.com\/item?id=7548991<\/a><br>[3]\u00a0<a href=\"https:\/\/github.com\/FiloSottile\/Heartbleed\/\" target=\"_tabs\" rel=\"noopener noreferrer\">https:\/\/github.com\/FiloSottile\/Heartbleed\/<\/a><br>[4]\u00a0<a href=\"http:\/\/filippo.io\/Heartbleed\/\" target=\"_tabs\" rel=\"noopener noreferrer\">http:\/\/filippo.io\/Heartbleed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Un aper\u00e7u de la vuln\u00e9rabilit\u00e9 de s\u00e9curit\u00e9 Heartbleed dans OpenSSL qui a affect\u00e9 Mailgun en 2014. En savoir plus&#8230;<\/p>\n","protected":false},"author":13,"featured_media":4555,"menu_order":0,"template":"","meta":{"_acf_changed":false,"footnotes":""},"blog_category":[22],"class_list":["post-23851","blog","type-blog","status-publish","has-post-thumbnail","hentry","blog_category-product"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Mailgun et Heartbleed - Transactional Email API Service For Developers | Mailgun<\/title>\n<meta name=\"description\" content=\"Un aper\u00e7u de la vuln\u00e9rabilit\u00e9 de s\u00e9curit\u00e9 Heartbleed dans OpenSSL qui a affect\u00e9 Mailgun en 2014. En savoir plus...\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.mailgun.com\/fr\/blog\/product\/mailgun-and-heartbleed\/\" \/>\n<meta property=\"og:locale\" content=\"fr_FR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Mailgun et Heartbleed - Transactional Email API Service For Developers | Mailgun\" \/>\n<meta property=\"og:description\" content=\"Un aper\u00e7u de la vuln\u00e9rabilit\u00e9 de s\u00e9curit\u00e9 Heartbleed dans OpenSSL qui a affect\u00e9 Mailgun en 2014. En savoir plus...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mailgun.com\/fr\/blog\/product\/mailgun-and-heartbleed\/\" \/>\n<meta property=\"og:site_name\" content=\"Transactional Email API Service For Developers | Mailgun\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mailgun.com\/wp-content\/uploads\/2025\/07\/MG-Blog-Product.png\" \/>\n\t<meta property=\"og:image:width\" content=\"720\" \/>\n\t<meta property=\"og:image:height\" content=\"448\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.mailgun.com\\\/fr\\\/blog\\\/product\\\/mailgun-and-heartbleed\\\/\",\"url\":\"https:\\\/\\\/www.mailgun.com\\\/fr\\\/blog\\\/product\\\/mailgun-and-heartbleed\\\/\",\"name\":\"Mailgun et Heartbleed - Transactional Email API Service For Developers | Mailgun\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.mailgun.com\\\/fr\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.mailgun.com\\\/fr\\\/blog\\\/product\\\/mailgun-and-heartbleed\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.mailgun.com\\\/fr\\\/blog\\\/product\\\/mailgun-and-heartbleed\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.mailgun.com\\\/wp-content\\\/uploads\\\/2025\\\/07\\\/MG-Blog-Product.png\",\"datePublished\":\"2026-09-16T09:57:52+00:00\",\"description\":\"Un aper\u00e7u de la vuln\u00e9rabilit\u00e9 de s\u00e9curit\u00e9 Heartbleed dans OpenSSL qui a affect\u00e9 Mailgun en 2014. En savoir plus...\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.mailgun.com\\\/fr\\\/blog\\\/product\\\/mailgun-and-heartbleed\\\/#breadcrumb\"},\"inLanguage\":\"fr-FR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.mailgun.com\\\/fr\\\/blog\\\/product\\\/mailgun-and-heartbleed\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/www.mailgun.com\\\/fr\\\/blog\\\/product\\\/mailgun-and-heartbleed\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.mailgun.com\\\/wp-content\\\/uploads\\\/2025\\\/07\\\/MG-Blog-Product.png\",\"contentUrl\":\"https:\\\/\\\/www.mailgun.com\\\/wp-content\\\/uploads\\\/2025\\\/07\\\/MG-Blog-Product.png\",\"width\":720,\"height\":448},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.mailgun.com\\\/fr\\\/blog\\\/product\\\/mailgun-and-heartbleed\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.mailgun.com\\\/fr\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Blog\",\"item\":\"https:\\\/\\\/www.mailgun.com\\\/fr\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Mailgun et Heartbleed\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.mailgun.com\\\/fr\\\/#website\",\"url\":\"https:\\\/\\\/www.mailgun.com\\\/fr\\\/\",\"name\":\"Transactional Email API Service For Developers | Mailgun\",\"description\":\"Des API d\u2019emails transactionnels puissantes qui vous permettent d'envoyer, de recevoir et de suivre des emails, con\u00e7ues pour les d\u00e9veloppeurs. En savoir plus d\u00e8s aujourd'hui !\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.mailgun.com\\\/fr\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.mailgun.com\\\/fr\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"fr-FR\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.mailgun.com\\\/fr\\\/#organization\",\"name\":\"Transactional Email API Service For Developers | Mailgun\",\"url\":\"https:\\\/\\\/www.mailgun.com\\\/fr\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/www.mailgun.com\\\/fr\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.mailgun.com\\\/wp-content\\\/uploads\\\/2025\\\/06\\\/cropped-android-chrome-512x512-1.png\",\"contentUrl\":\"https:\\\/\\\/www.mailgun.com\\\/wp-content\\\/uploads\\\/2025\\\/06\\\/cropped-android-chrome-512x512-1.png\",\"width\":512,\"height\":512,\"caption\":\"Transactional Email API Service For Developers | Mailgun\"},\"image\":{\"@id\":\"https:\\\/\\\/www.mailgun.com\\\/fr\\\/#\\\/schema\\\/logo\\\/image\\\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Mailgun et Heartbleed - Transactional Email API Service For Developers | Mailgun","description":"Un aper\u00e7u de la vuln\u00e9rabilit\u00e9 de s\u00e9curit\u00e9 Heartbleed dans OpenSSL qui a affect\u00e9 Mailgun en 2014. En savoir plus...","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.mailgun.com\/fr\/blog\/product\/mailgun-and-heartbleed\/","og_locale":"fr_FR","og_type":"article","og_title":"Mailgun et Heartbleed - Transactional Email API Service For Developers | Mailgun","og_description":"Un aper\u00e7u de la vuln\u00e9rabilit\u00e9 de s\u00e9curit\u00e9 Heartbleed dans OpenSSL qui a affect\u00e9 Mailgun en 2014. En savoir plus...","og_url":"https:\/\/www.mailgun.com\/fr\/blog\/product\/mailgun-and-heartbleed\/","og_site_name":"Transactional Email API Service For Developers | Mailgun","og_image":[{"width":720,"height":448,"url":"https:\/\/www.mailgun.com\/wp-content\/uploads\/2025\/07\/MG-Blog-Product.png","type":"image\/png"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.mailgun.com\/fr\/blog\/product\/mailgun-and-heartbleed\/","url":"https:\/\/www.mailgun.com\/fr\/blog\/product\/mailgun-and-heartbleed\/","name":"Mailgun et Heartbleed - Transactional Email API Service For Developers | Mailgun","isPartOf":{"@id":"https:\/\/www.mailgun.com\/fr\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mailgun.com\/fr\/blog\/product\/mailgun-and-heartbleed\/#primaryimage"},"image":{"@id":"https:\/\/www.mailgun.com\/fr\/blog\/product\/mailgun-and-heartbleed\/#primaryimage"},"thumbnailUrl":"https:\/\/www.mailgun.com\/wp-content\/uploads\/2025\/07\/MG-Blog-Product.png","datePublished":"2026-09-16T09:57:52+00:00","description":"Un aper\u00e7u de la vuln\u00e9rabilit\u00e9 de s\u00e9curit\u00e9 Heartbleed dans OpenSSL qui a affect\u00e9 Mailgun en 2014. En savoir plus...","breadcrumb":{"@id":"https:\/\/www.mailgun.com\/fr\/blog\/product\/mailgun-and-heartbleed\/#breadcrumb"},"inLanguage":"fr-FR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mailgun.com\/fr\/blog\/product\/mailgun-and-heartbleed\/"]}]},{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/www.mailgun.com\/fr\/blog\/product\/mailgun-and-heartbleed\/#primaryimage","url":"https:\/\/www.mailgun.com\/wp-content\/uploads\/2025\/07\/MG-Blog-Product.png","contentUrl":"https:\/\/www.mailgun.com\/wp-content\/uploads\/2025\/07\/MG-Blog-Product.png","width":720,"height":448},{"@type":"BreadcrumbList","@id":"https:\/\/www.mailgun.com\/fr\/blog\/product\/mailgun-and-heartbleed\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.mailgun.com\/fr\/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https:\/\/www.mailgun.com\/fr\/blog\/"},{"@type":"ListItem","position":3,"name":"Mailgun et Heartbleed"}]},{"@type":"WebSite","@id":"https:\/\/www.mailgun.com\/fr\/#website","url":"https:\/\/www.mailgun.com\/fr\/","name":"Transactional Email API Service For Developers | Mailgun","description":"Des API d\u2019emails transactionnels puissantes qui vous permettent d'envoyer, de recevoir et de suivre des emails, con\u00e7ues pour les d\u00e9veloppeurs. En savoir plus d\u00e8s aujourd'hui !","publisher":{"@id":"https:\/\/www.mailgun.com\/fr\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mailgun.com\/fr\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"fr-FR"},{"@type":"Organization","@id":"https:\/\/www.mailgun.com\/fr\/#organization","name":"Transactional Email API Service For Developers | Mailgun","url":"https:\/\/www.mailgun.com\/fr\/","logo":{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/www.mailgun.com\/fr\/#\/schema\/logo\/image\/","url":"https:\/\/www.mailgun.com\/wp-content\/uploads\/2025\/06\/cropped-android-chrome-512x512-1.png","contentUrl":"https:\/\/www.mailgun.com\/wp-content\/uploads\/2025\/06\/cropped-android-chrome-512x512-1.png","width":512,"height":512,"caption":"Transactional Email API Service For Developers | Mailgun"},"image":{"@id":"https:\/\/www.mailgun.com\/fr\/#\/schema\/logo\/image\/"}}]}},"_links":{"self":[{"href":"https:\/\/www.mailgun.com\/fr\/wp-json\/wp\/v2\/blog\/23851","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mailgun.com\/fr\/wp-json\/wp\/v2\/blog"}],"about":[{"href":"https:\/\/www.mailgun.com\/fr\/wp-json\/wp\/v2\/types\/blog"}],"author":[{"embeddable":true,"href":"https:\/\/www.mailgun.com\/fr\/wp-json\/wp\/v2\/users\/13"}],"version-history":[{"count":0,"href":"https:\/\/www.mailgun.com\/fr\/wp-json\/wp\/v2\/blog\/23851\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.mailgun.com\/fr\/wp-json\/wp\/v2\/media\/4555"}],"wp:attachment":[{"href":"https:\/\/www.mailgun.com\/fr\/wp-json\/wp\/v2\/media?parent=23851"}],"wp:term":[{"taxonomy":"blog_category","embeddable":true,"href":"https:\/\/www.mailgun.com\/fr\/wp-json\/wp\/v2\/blog_category?post=23851"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}