I was looking at a reliable and portable way to check the OpenSSL version on GNU/Linux and other systems, so users can easily discover if they should upgrade their SSL because of the Heartbleed bug.
I thought it would be easy, but I quickly ran into a problem on Ubuntu 12.04 LTS with the latest OpenSSL 1.0.1g:
openssl version -a
I was expecting to see a full version, but instead I got this:
OpenSSL 1.0.1 14 Mar 2012 built on: Tue Jun 4 07:26:06 UTC 2013 platform: [...]
To my unpleasant surprise, the version letter doesn't show. No f, no g there, just "1.0.1" and that's it. The listed dates do not assist in discovering a (non-)vulnerable version either.
The difference between 1.0.1 (a-f) and 1.0.1g is crucial.
- What is a reliable way to check the version, preferably cross distro?
- Why isn't the version letter showing in the first place? I was unable to test this on anything else but Ubuntu 12.04 LTS.
Others are reporting this behaviour as well. A few examples:
Some (distro-specific) suggestions rolling in:
- Ubuntu and Debian:
apt-cache policy openssland
apt-cache policy libssl1.0.0. Compare the version numbers to the packages here: http://www.ubuntu.com/usn/usn-2165-1/
- Fedora 20:
yum info openssl(thanks @znmeb on twitter) and
yum info openssl-libs
Checking if a older version of OpenSSL is still resident:
- It's not completely reliable, but you can try
lsof -n | grep ssl | grep DEL. See Heartbleed: how to reliably and portably check the OpenSSL version? on why this may not work for you.
It turns out that updating the OpenSSL package on Ubuntu and Debian isn't always enough. You should also update the libssl1.0.0 package, and -then- check if
openssl version -a indicates
built on: Mon Apr 7 20:33:29 UTC 2014.