Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

I know that 13.04 is affected (or at least my installation is) because of the OpenSSL version currently installed. However, after running

sudo apt-get update
sudo apt-get upgrade

I checked my OpenSSL version and it was still an unpatched build.

I also checked and 13.04 isn't listed. What can I do to patch OpenSSL on my machine?

share|improve this question

marked as duplicate by EEAA, Rex, Jacob, Ward, MadHatter Apr 8 '14 at 8:00

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

13.04 is out of support. You should not be running it. – Michael Hampton Apr 8 '14 at 2:24
That doesn't help. :) – dlo Apr 8 '14 at 2:27
Not a dupe. Different question. – dlo Apr 8 '14 at 2:30
Yes, it's the best help you're likely to get. You really should not be doing anything important with very-short-lifecycle distributions like non-LTS Ubuntu unless you are also keeping it upgraded to the latest supported releases. You will not get an official patch for this issue on 13.04. Period. It's past time to upgrade. – Michael Hampton Apr 8 '14 at 2:30
up vote 5 down vote accepted

Note that 13.04 is no longer supported. Upgrading to a supported version is the recommended action. But if a short term solution is needed, it's possible to rebuild the packages from source (sample instructions) with a patch applied, e.g.:

sudo apt-get install build-essential fakeroot dpkg-dev devscripts
apt-get source openssl
sudo apt-get build-dep openssl
cd openssl
dch -i
# ...apply patch...
dpkg-buildpackage -rfakeroot -uc -b
cd ..
sudo dpkg -i *.deb

From the Ubuntu changelog page for openssl, find the diff file for quantal, which happens to have the same base version of openssl (1.0.1c). This should apply cleanly against the latest source for raring. If following the instructions from the link above, apply the patch after doing the dch -i part, choose a sensible version number. Ignore/delete the rejected patch for debian/changelog, and continue the process.

share|improve this answer
This will deal with this particular issue, but 13.04 still has a variety of other unpatched security issues. People really should be upgrading. – Michael Hampton Apr 11 '14 at 16:41

Not the answer you're looking for? Browse other questions tagged or ask your own question.