4

I am having a strange problem, my system is exposed to heartbleed, and I am trying to fix it by using: apt-get clean,
apt-get update
and
apt-get upgrade openssl

but the response is: 

Reading package lists... Done
Building dependency tree
Reading state information... Done
Calculating upgrade... Done
openssl is already the newest version.
The following packages have been kept back:
  libncurses5 libncursesw5 libssl-dev
0 upgraded, 0 newly installed, 0 to remove and 3 not upgraded.

my openssl version is:
openssl version -a 

OpenSSL 1.0.1f-dev xx XXX xxxx
built on: Mon Dec 23 14:23:57 UTC 2013
platform: debian-amd64
options:  bn(64,64) rc4(8x,int) des(idx,cisc,16,int) blowfish(idx)
compiler: gcc -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -m64 -DL_ENDIAN -DTERMIO -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2 -Wl,-z,relro -Wa,--noexecstack -Wall -DMD32_REG_T=int -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM
OPENSSLDIR: "/usr/lib/ssl"

openssl version -b 

built on: Mon Dec 23 14:23:57 UTC 2013

I had thought that the problem is in the sources list and here is my sources list:

#deb http://ftp.debian.org/debian stable main contrib

#deb http://ftp.debian.org/debian/ wheezy-updates main contrib

#deb http://security.debian.org/ wheezy/updates main contrib
deb http://http.debian.net/debian wheezy main
deb-src http://http.debian.net/debian wheezy main

deb http://http.debian.net/debian wheezy-updates main
deb-src http://http.debian.net/debian wheezy-updates main

deb http://security.debian.org/ wheezy/updates main
deb-src http://security.debian.org/ wheezy/updates main

you can see the old ones in comment, but updating and trying to upgrade even with apt-get upgrade make no progress.

My serevr is on rackspace if it's somehow relevant...

I really don't know what to do, please help me.

Improve this question
2
  • yes I had tried...
    – Wazime
    May 2, 2014 at 10:42
  • 1
    I'm no debian guru, but if I correctly understand this answer, Wheezy should be on 1.0.1e. Have you perchance installed your own version of OpenSSL?
    – MadHatter
    May 2, 2014 at 11:15

2 Answers 2

Reset to default
4

Thanks all for your efforts, here is how I had solved it:
apparently my openssl was from a test package instead of stable one. so the aptitude always thought the package is up to date.

in order to fix it I had run the next commands:
apt-get install openssl=1.0.1a-2+deb7u7
apt-get install libssl1.0.0=1.0.1e-2+deb7u7

it forced debian to install this packages with the exact version. and now it works

Improve this answer
1
  • I'll take that as a resounding "yes" to my question above, then! Thank you for coming back and posting a cogent answer to your own question; this may help others in future. Don't forget to accept it by clicking the tick outline next to it, once the site will permit that.
    – MadHatter
    May 7, 2014 at 7:35
2

Try

apt-get install openssl

That should force Debian reinstalling/upgrading only the OpenSSL again. See what version it installs.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.