0

I have CentOS release 6.2 (Final) installed on my server. I have updated openssl from openssl source file "openssl-1.0.1g.tar.gz". But when i check it through openssl version command it shows me "OpenSSL 1.0.1g 7 Apr 2014" which is correct and updated one. But when i check using "rpm -q openssl" command it gives me "openssl-1.0.1e-16.el6_5.4.x86_64" this ouput that should be 5.7. And also when i use rpm -q --changelog openssl then it gives me below output

* Tue Jan 07 2014 Tomáš Mráz 1.0.1e-16.4 - fix CVE-2013-4353 - Invalid TLS handshake crash

  • Mon Jan 06 2014 Tomáš Mráz 1.0.1e-16.3
  • fix CVE-2013-6450 - possible MiTM attack on DTLS1

  • Fri Dec 20 2013 Tomáš Mráz 1.0.1e-16.2

  • fix CVE-2013-6449 - crash when version in SSL structure is incorrect

Where it should show as below output

* Mon Apr 07 2014 Tomáš Mráz 1.0.1e-16.7 - fix CVE-2014-0160 - information disclosure in TLS heartbeat extension

i.e the updated one Apr 07 2014.

How do i resolve this problem? Please help.


I have successfully updated to 1.0.1g. openssl version shows "OpenSSL 1.0.1g 7 Apr 2014". rpm -q openssl shows "openssl-1.0.1e-16.el6_5.7.x86_64" rpm -q --changelog openssl gives output as * Mon Apr 07 2014 Tomáš Mráz 1.0.1e-16.7 - fix CVE-2014-0160 - information disclosure in TLS heartbeat extension * Tue Jan 07 2014 Tomáš Mráz 1.0.1e-16.4 - fix CVE-2013-4353 - Invalid TLS handshake crash * Mon Jan 06 2014 Tomáš Mráz 1.0.1e-16.3 - fix CVE-2013-6450 - possible MiTM attack on DTLS1

But when i check my server-status page it shows me ssl version as "Apache/2.4.9 (Unix) OpenSSL/1.0.1e-fips". I have stop and started my apache server. Also i have changed my certificate and key. Is i need to need anything more. Please help

3
  • You installed from source, right? That doesn't update the rpm version...
    – Nathan C
    May 23, 2014 at 12:42
  • 1
    Update your system normally. May 23, 2014 at 13:35
  • 1
    LINK: CentOS Manual - yum updates. I would advise you stick to the package manager at your (apparent) experience level. You may even want to enable CentOS's auto-updates. May 23, 2014 at 14:55

2 Answers 2

1

The reason for this is that you currently have two openssl packages installed on your system:

  1. First one is installed by you manually via openssl-1.0.1g.tar.gz
  2. Second one is installed via your distributions package manager. The rpm commands you use only work on packages installed via your distributinos package manager or packages that are installed via an rpm, and not manually.
1

Further to other comments, even though you have installed both packages (one by rpm and one from source) you may still only be running the rpm version. Installing the source, and not starting the new version, means that the original is running. Next, if you try to run the one from source, you may run into a port conflict (the "old" version already has posession of the port, so the "new" version can't grab it).

I see two possible solutions for you:

Option 1. use your appropriate package manager (rpm or YUM) to unistall the old version of OpenSSL, and then attempt to start the new service. You may need to copy an init script from the default install location into the appropriate runlevel directory.

option 2. remove the version that you installed from source (a.k.a. "tarball") and then either find the updated rpm, download and install it, or install and configure YUM (not brain surgery) and then install the latest available package with YUM.

In the past, in similar situation working with my clients, I uninstalled the tarball and installed latest pacaked with YUM. YUM is very helpful, especially when dealing with dependencies.

Side note: only install packaged from trusted repositories.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .