After the heartbleed bug i have updated my openssl to 1.0.1g. But to my shock when today i see my server-status it shows me openssl version 1.0.1e that was vulnerable to Heartbleed. I have upgraded my openssl through rpm. When i have upgraded i have checked with command openssl version. It gives me output as "OpenSSL 1.0.1g 7 Apr 2014" i.e i have successfully updated the rpm. But when i check with following rpm command rpm -q openssl. It shows me output as "openssl-1.0.1e-16.el6_5.4.x86_64". Also i have used rpm info openssl it gives same 1.0.1e version of openssl How to solve this issue. so that my site is not vulnerable to Heartbleed.
RedHat backported the Heartbleed fix to OpenSSL 1.0.1e. The OpenSSL package that contains the CVE-2014-0160 fix is
openssl-1.0.1e-16.el6_5.7.x86_64. As mentioned elsewhere you can double check that with the
rpm -q --changelog openssl command - the change is dated 7th April 2014.
If you've attempted to install 1.0.1g on the server, you have done so outside the standard CentOS
yum update process, as RedHat (and thus CentOS) doesn't have an official 1.0.1g version.