4月9日OpenSSL爆出了本年度最严重的安全漏洞“hearbleed”，意为“心脏出血”，4月10日，国家互联网应急中心发布通报称诸多服务供应商均受到漏洞影响，在此情势下，致远软件开发在第一时间对我们的OA产品进行了研究，得出以下结论：
致远协同产品使用的HTTPS是采用的第三方免费开源产品Apache HTTPServer + openssl，
A6所有标准产品系列和A8所有标准产品系列安装程序自带的Apache/openssl版本是0.9.8、0.9.9，这个版本是安全的。
在个别项目中，如果下载了更高版本的Apache/openssl，将受该漏洞影响，具体解决做法参考如下方案：
1、如果是1.0.1版本，升级至1.0.1g即可解决
2、如果是1.0.2版本，官方目前暂无补丁包，有2种解决方法：
（1）可以下载opeessl源代码，修改其中2行代码，编译即可。（不推荐此种方式）
（2）等候OpenSSL出官方补丁。致远开发已经安排人员跟进，如果有补丁包，会第一时间公布。
附：OpenSSL关于此漏洞事件的公告
OpenSSL Security Advisory [07 Apr 2014]
========================================
TLS heartbeat read overrun (CVE-2014-0160)
==========================================
A missing bounds check in the handling of the TLS heartbeat extension can be
used to reveal up to 64k of memory to a connected client or server.
Only 1.0.1 and 1.0.2-beta releases of OpenSSL are affected including
1.0.1f and 1.0.2-beta1.
Thanks for Neel Mehta of Google Security for discovering this bug and to
Adam Langley <agl@chromium.org> and Bodo Moeller <bmoeller@acm.org> for
preparing the fix.
Affected users should upgrade to OpenSSL 1.0.1g. Users unable to immediately
upgrade can alternatively recompile OpenSSL with -DOPENSSL_NO_HEARTBEATS.
1.0.2 will be fixed in 1.0.2-beta2.
OpenSSL Security Advisory [07 Apr 2014]
========================================
TLS heartbeat read overrun (CVE-2014-0160)
==========================================
A missing bounds check in the handling of the TLS heartbeat extension can be
used to reveal up to 64k of memory to a connected client or server.
Only 1.0.1 and 1.0.2-beta releases of OpenSSL are affected including
1.0.1f and 1.0.2-beta1.
Thanks for Neel Mehta of Google Security for discovering this bug and to
Adam Langley <agl@chromium.org> and Bodo Moeller <bmoeller@acm.org> for
preparing the fix.
Affected users should upgrade to OpenSSL 1.0.1g. Users unable to immediately
upgrade can alternatively recompile OpenSSL with -DOPENSSL_NO_HEARTBEATS.
1.0.2 will be fixed in 1.0.2-beta2.
