6

I need to upgrade OpenSSL on my CentOS server to 0.9.8k or higher, however the latest version in the official CentOS repositories is 0.9.8e, much too old. Is there a 3rd party repository I can use that has newer versions of OpenSSL libraries? If not, can someone provide a quick walkthrough of compiling a newer version of OpenSSL for CentOS? I need it to replace the built in version, so the walkthrough would have to explain how to create a CentOS-compatible RPM.

  • 2
    Why do you want to get that 0.9.8k or higher? Do you need any new feature or do you need a CVE bugfix? The latter is usually backported to 0.9.8e by RedHat. See Rilindos answer below. – Nils Nov 9 '11 at 20:34
  • Myself, I am looking for specific OpenSSL features, such as Server Name Indication. Apparently there are no OpenSSL 1.x RPMs available for EL5, so I'd simply need to compile or roll my own RPMs to install to /opt or elsewhere , and tell specific applications to use those specific OpenSSL libraries. – Stefan Lasiewski Nov 14 '11 at 18:37
11

Let me guess - PCI?

What you really want is to look at Red Hat's CVE archives (which CentOS is based on) and verified whether the vulnerability has been fixed based on that list (most of the time, it has been). If you are using a third-party scanner that doesn't recognize your current version, look up the OVAL definitions to see the status of the vulnerabilities as well as whether the fixes were back ported; from there, you can map them to the current "generic" versions of your applications / libraries (in this case, OpenSSL).

Red Hat's link gives more details (which CentOS reference) as their backports policy. You may want to review it and save yourself the trouble of rebuilding OpenSSL.

8

Be aware that RedHat backports security fixes and such to packages and only increments the package subversion number and not the versioning of the package. Since Centos comes directly from RedHat, I might expect the same from their packaging as well.

1
+50

Upgrade to Centos 6. It has version 1.0.0 built-in. See the list of packages and RPMs here: http://mirror.centos.org/centos/6/os/i386/Packages/

But it is never a good idea to install two versions of the same software on one system.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.