0

We are still having heartbleed issues with one of our servers. We did the update with yum and restarted apache and any service that was using the vulnerable version of openssl. When we test our site to see if it is still vulnerable it says that it is. Our server has apache 2.4.7 compiled from source. Does anyone have any ideas of why it would say that we are still using the vulnerable version of Openssl? If I do a "rpm -qa | grep ssl" I get the following:

nss_compat_ossl-0.9.6-1.el6.x86_64 
pyOpenSSL-0.10-2.el6.x86_64 
openssl-1.0.1e-16.el6_5.7.x86_64 
openssl-devel-1.0.1e-16.el6_5.7.x86_64
1
  • 3
    You might need to re-compile.
    – Zoredache
    Apr 14, 2014 at 16:57

2 Answers 2

4

There are 2 possibilities:

1) Your compiled version of Apache uses a compiled version of OpenSSL from another location. Just use ldd on the binary of Apache and it shall tell you what OpenSSL shared library it used:

# ldd /usr/sbin/nginx  | grep -i ssl
    libssl.so.10 => /usr/lib64/libssl.so.10 (0x0000003816000000)

If this gives you not output, then it is probably the next possibility.

2) You have OpenSSL statically built into Apache.

In either case, you need to rebuild it.

0

I believe that you are compiling your apache with static libraries, so you may need to recompile after updating libssl-dev and openssl.

1
  • While your answer is accurate please try to avoid duplication with previously posted answers. Thanks. :) Apr 15, 2014 at 16:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .