2

After the heartbleed bug i have updated my openssl to 1.0.1g. But to my shock when today i see my server-status it shows me openssl version 1.0.1e that was vulnerable to Heartbleed. I have upgraded my openssl through rpm. When i have upgraded i have checked with command openssl version. It gives me output as "OpenSSL 1.0.1g 7 Apr 2014" i.e i have successfully updated the rpm. But when i check with following rpm command rpm -q openssl. It shows me output as "openssl-1.0.1e-16.el6_5.4.x86_64". Also i have used rpm info openssl it gives same 1.0.1e version of openssl How to solve this issue. so that my site is not vulnerable to Heartbleed.

  • 1
    Exactly what did you do? – Michael Hampton May 20 '14 at 6:00
  • 3
    You are aware of Red Hat's policy of backporting which CentOS follows as well? "Customers need to be aware that just looking at the version number of a package will not tell them if they are vulnerable or not" – HBruijn May 20 '14 at 6:14
  • See serverfault.com/questions/535606/… for a slightly longer explanation if you're not. – MadHatter May 20 '14 at 7:25
4

RedHat backported the Heartbleed fix to OpenSSL 1.0.1e. The OpenSSL package that contains the CVE-2014-0160 fix is openssl-1.0.1e-16.el6_5.7.x86_64. As mentioned elsewhere you can double check that with the rpm -q --changelog openssl command - the change is dated 7th April 2014.

If you've attempted to install 1.0.1g on the server, you have done so outside the standard CentOS yum update process, as RedHat (and thus CentOS) doesn't have an official 1.0.1g version.

| improve this answer | |
  • Hi mykel, I also need to update to OpenSSL 1.0.1g, for other reasons not related to heartbleed. I'm on CentOS 6.5 and there is no yum update available. Would you mind showing how to update if possible with a package and not source – Anagio Jun 3 '14 at 22:51
3

rpm -q --changelog should show a fix for CVE-2014-0160 - information disclosure in TLS heartbeat extension once you've upgraded successfully.

| improve this answer | |
  • Yes, i have checked with rpm -q openssl --changelog command. It gives below output $rpm -q openssl --changelog * Tue Jan 07 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-16.4 - fix CVE-2013-4353 - Invalid TLS handshake crash * Mon Jan 06 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-16.3 - fix CVE-2013-6450 - possible MiTM attack on DTLS1 – Huzefa May 20 '14 at 7:33
  • It shows latest patch date of openssl "Jan 07 2014". Does it means that server is already updated. I dont have to do anythind. – Huzefa May 20 '14 at 7:33
  • That means it is not the latest version, the update for CVE-2014-0160 was on April 7th. – HBruijn May 20 '14 at 7:36
  • I have updated it from "openssl.org/source/openssl-1.0.1g.tar.gz" but it is showing me "openssl-1.0.1e-16.el6_5.4.x86_64" – Huzefa May 23 '14 at 6:03
  • But here version should be "openssl-1.0.1e-16.el6_5.7.x86_64". Also it is showing me old version when i use rpm -q --changelog openssl command. – Huzefa May 23 '14 at 6:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.