-2

I am running a fedora 15 2.6.32-042stab081.3 x64, I have OpenSSL 1.0.0j-fips 10 May 2012 which I understand to not be infected.

However every test tool out there is reporting the site maybe vulnerable based on the age of the certificate. So while my system doesn't need to be patched for this, the mass hysteria and panic suggests I should update so users are not presented with the site maybe insecure. by these "check tools"

However yum update, is offering nothing. I can't see to find a newer rpm, so I'm at a loss of how to update openSSL? install from source?

Any advice or points would be a great help.

UPDATE ::: I have downloaded the source for openssl-1.0.1g and installed from source, however when running openssl version, it still reports the old version?

11
  • 6
    Fedora 15 is unsupported since 2012 and has no place on an internet facing server. If you run Fedora, keep it up to date with a supported version. Also, if the certificates are expired, you need to create new ones. That is nothing yum can help you with.
    – Sven
    Apr 10, 2014 at 9:33
  • @svW, That is not the most helpful comment. The certs have not expired and I didn't state that they have. I am aware of how to renew and update my certs. I just thought since I am going to have to revoke/renew them that I should update open SSL at the same time. Apr 10, 2014 at 10:16
  • 2
    There is no reason to update your openssl as it is not affected by heartbleed. There is every reason to update your OS as having been unsupported for 2 years it likely contains other unpatched security vulnerabilities.
    – user9517
    Apr 10, 2014 at 10:34
  • 2
    @ShaunForsyth: I've inferred the expired certificate from the "age of the certificate" statement, which was apparently incorrect. Nevertheless, I repeat: Don't waste a minute on a non-issue when you have a complete server that needs to be update to a supported OS now.
    – Sven
    Apr 10, 2014 at 10:46
  • 1
    You will have to make a backup anyway before upgrading. Unfortunately, it's quite possible to break your systems while doing the five required updates (15->16->17->18->19->20) before you end up with a current version. Due to the short support cycle of Fedora, it is really unsuitable for a server install and I recommend something like Ubuntu or CentOS instead. My plan would be to setup a second VPS with one of those systems and after you have configured this correctly, move the data over and turn off the old machine.
    – Sven
    Apr 10, 2014 at 11:18

1 Answer 1

1

While this should be a non-issue on Fedoras earlier than 18, my Fedora 17 happened to get detected by some vulnerability scanner. You shouldn't update your SSL version by hand, since it would make your another packages, like httpd stop working due to incorrect ABI.

What I did was rebuilding RPM packages without heartbeat support: $ yum groupinstall rpmdevtools $ yumdownloader --source openssl $ rpm -ivh ./openssl*.src.rpm $ nano ~/rpmbuild/SPECS/openssl.spec --- replace a line like: Release: 1%{?dist} --- with something like: Release: 1%(?dist}.heartbleed --- replace a line like: RPM_OPT_FLAGS="$RPM_OPT_FLAGS -Wa,--noexecstack" --- with something like: RPM_OPT_FLAGS="$RPM_OPT_FLAGS -Wa,--noexecstack -DOPENSSL_NO_HEARTBEATS" $ rpmbuild -ba ~/rpmbuild/SPECS/openssl.spec $ i386 rpmbuild -ba ~/rpmbuild/SPECS/openssl.spec # execute it only if on x86_64 $ rpm -Fvh ~/rpmbuild/RPMS/*/openssl*.rpm

Not the answer you're looking for? Browse other questions tagged .