1

I have some prod servers which are running with openssl version as 1.0.1f-1ubuntu2.16 . Since on 1 March 2016 a new ssl version will be released which will cover a majority of HIGH severity bugs, How do i upgrade my prod servers to this latest openssl release ?

2
  • How do you normally update your systems ?
    – user9517
    Feb 29, 2016 at 7:28
  • apt-get update / upgrade . I was thinking of downloading the source when it's available, i want to be sure it won't break anything Feb 29, 2016 at 8:22

1 Answer 1

4

You don't.

Most reputable distributions take security fixes and retrospectively apply them to the current version of (in this case) openSSL that they distribute.

This allows them to keep up-to-date with security patches while lessening the risk of new bugs appearing from the use of relatively untested software.

You'll notice that openSSL will update quite often. If you install apt-listchanges it will show you the changelog during these updates so that you can confirm that the HIGH severity bugs have been patched.

But if you're insisting on the latest version, then you'll probably have to compile it yourself.

4
  • you mean download from the source and do a make ? Feb 29, 2016 at 8:23
  • Yes. But if you install into the default locations and overwrite your existing openSSL, then expect your system to break. If you (sensibly) install into a different directory (such as /usr/local) then you'll have to ensure that applications find it - they'll use the distro provided version by default. Feb 29, 2016 at 9:32
  • Ubuntu 14.04 LTS end of life is April 2019. Latest version of OpenSSL supported for it is 1.0.1f. OpenSSL will cease support for 1.0.1 versions on 2016-12-31. Is there a problem here? Or is that normal? No ALPM (and HTTP2) for Ubuntu 14.04 it seems. launchpad.net/ubuntu/+source/openssl , openssl.org/policies/releasestrat.html
    – mikato
    Oct 21, 2016 at 22:01
  • @mikato this is exactly my question as well. Now that we have passed EOL the version is still not upgradable. I am asking myself if Ubuntu will update to 1.0.2 or not. If not I must consider compiling like garethTheRed mentioned.
    – merlin
    Jan 5, 2017 at 9:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .