0

I updated to openssl 1.0.2h, but when I hit

lsof | grep -i libssl 

I still get 1.0.1e

nginx     19645        nginx  mem       REG         182,420273    441256     398853 /usr/lib64/libssl.so.1.0.1e

I tried restarting nginx, apache and mysql, but the old version still remains although openssl version returns

OpenSSL 1.0.2h  3 May 2016

I followed the tutorial from here.

Also, before I posted this, I followed the answer from here.

Do you know how I can make it use the latest version?

  • 1
    Did you restart nginx? – garethTheRed Jul 13 '16 at 15:52
  • Yep. Unfortunately, it didn't do the trick. Not only nginx uses the old version of ssl, but also apache, mysql, postfix, root etc. – Punct Ulica Jul 13 '16 at 15:52
  • In additon to @garethTheRed's question, how did you install openssl and nginx? What OS is this? – EEAA Jul 13 '16 at 15:52
  • 3
    Can you answer @EEAA's question about how you installed it? – garethTheRed Jul 13 '16 at 16:09
  • 1
    Maybe you should consider reverting to using rpm for your package and install 1.0.1e from the repo? That should be patched. – garethTheRed Jul 14 '16 at 9:28
0

You may run ldd /path/to/nginx to see how it's linked.

0

You are solving this problem the wrong way. You need to understand Red Hat's patching policy (CentOS following upstream as it does, this is therefore CentOS's patching policy as well).

As long as C6 is supported (ie, until 2020-11-30), and as long as you keep your C6 box fully up-to-patch, you will be running non-vulnerable versions of OpenSSL even though the OpenSSL version number does not change.

Once you start building your own version of OpenSSL, you will find you have to rebuild (or at least relink) lots of major tools, to get them to pick up your handbuilt version, and you will have to do this each time a new version of OpenSSL comes out. It is a slough of despond, it is completely pointless, and it is unprofessional to boot.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.