3

As recommended by openssl.org I'm trying to update OpenSSL from 1.0.1e to 1.0.1g. Fixes for most linux distributions have already deployed, but, what should be done on windows? we are using win server 2003 x64; OpenSSL 1.0.1e was installed using "Win64 OpenSSL v1.0.1g" installer from Shining Light Productions web site (http://slproweb.com/products/Win32OpenSSL.html). 1.0.1g installer is available from Shining Light people, but that is a full intaller, not an update. I don't want to screw up our SSL certificate configuration and I don't really know exactly what binaries/files should be replaced/edited and where can I find them. Thanks in advance for your help, any info will be be appreciated.

UPDATE: Thank you Ryan for your suggestion, Thomas Hruska, from Shining Light, nicely took the time to reply my email:

"1.0.1e is binary compatible with 1.0.1g. Just make sure the web server is stopped before installing to avoid issues with overwriting files in use, which you have to do anyway after updating OpenSSL."

1
  • 3
    Contact the vendor ([email protected]) and ask them (I think it's just one dude, actually,) what the recommended upgrade process is...
    – Ryan Ries
    Apr 10, 2014 at 4:41

1 Answer 1

1

According to this page, the flaw has been fixed in the latest release (1.0.1g): http://www.pcworld.com/article/2140920/heartbleed-bug-in-openssl-puts-encrypted-communications-at-risk.html

(Of course, it could be wrong--if you claim to have installed this, when was it that you installed it? I know it's reaching but it's possible that they updated that release on the downloads page to include the fix without bumping up any version numbers.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .