6

I'm trying to check if I running the latest OpenSSL version, my main concern is the heartbleed bug.

I tried 2 commands:

  • openssl version
  • yum info openssl


    openssl version output

    OpenSSL 1.0.1e-fips 11 Feb 2013


    yum info openssl output

    Installed Packages

    Name : openssl

    Arch : x86_64

    Version : 1.0.1e

    Release : 16.el6_5.14

    ...


I have a couple of questions:

  1. Why do I get different versions from these 2 commands?
  2. How do I check the heartbleed vulnerability without having the 443 port open?
8

The name of the RPM package is simply not the same as the version the software itself returns.

One of the reasons for that is Red Hat & CentOS backports security updates and bug fixes to the software version that was initially shipped. They take a fix for a security flaw out of the most recent version of an upstream software package i.e. openssl 1.0.1h and apply that fix to an older version of the package was distributed : i.e. openssl 1.0.1e. That policy is the reason for a patch level string in the package name in addition to the software version number.

The version output of the openssl version command remains unchanged 1.0.1e regardless of your actual patch level.

rpm -q --changelog openssl shows which updates the package maintainer has included in the version you have currently installed.

The most current version shows:

* Mon Jun 02 2014 Tom Mraz <tmraz redhat.com> 1.0.1e-16.14
- fix CVE-2010-5298 - possible use of memory after free
- fix CVE-2014-0195 - buffer overflow via invalid DTLS fragment
- fix CVE-2014-0198 - possible NULL pointer dereference
- fix CVE-2014-0221 - DoS from invalid DTLS handshake packet
- fix CVE-2014-0224 - SSL/TLS MITM vulnerability
- fix CVE-2014-3470 - client-side DoS when using anonymous ECDH

* Mon Apr 07 2014 Tom Mraz <tmraz redhat.com> 1.0.1e-16.7
- fix CVE-2014-0160 - information disclosure in TLS heartbeat extension

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.