-1

I'm trying to update openssl on CentOS 7.3. I tried at the beginning to update it using yum update openssl-devel' but it says : No packages marked for update

When I'm running yum info openssl the version number that appears is : 1.0.1e

Afterwards I installed openssl 1.0.2i from source using this guide on CentOS 7.3. I think that my problem is in these two lines:

mv /usr/bin/openssl /root/
ln -s /usr/local/ssl/bin/openssl /usr/bin/openssl

In both cases when I'm running openssl version after the installation, I'm stil see the old one: 

openssl version
OpenSSL 0.9.8l 5 Nov 2009

What could be the problem?

Improve this question
7
  • Which distro are you using ?
    – Tolsadus
    Dec 21, 2016 at 9:49
  • Add a lot more details about your environment, including the steps you followed. No one wants to read an external guide to try to come up with an idea what you might have done wrong.
    – Sven
    Dec 21, 2016 at 9:51
  • 1
    Following any part of that guide is a mistake. At this point you should probably restore the system from backups taken from before you embarked on this adventure, or reinstall the system from scratch. It may not be possible to fix it otherwise.
    – Michael Hampton
    Dec 22, 2016 at 6:53
  • 1
    What could be the problem? cluelessness
    – user9517
    Dec 22, 2016 at 6:56
  • 2
    The whole premise is wrong. You do not need to "update" openssl by downloading the source and building it yourself in order to resolve security issues.
    – Michael Hampton
    Dec 22, 2016 at 7:15

1 Answer 1

Reset to default
2

I really don't think you're giving us the full picture here. You almost certainly didn't 'just follow' the linked document. If you did then you would not have OpenSSL 0.9.8l 5 Nov 2009 from 7 years ago on your system. At this point you should consider your system horribly misconfigured and you should just reinstall it.

If you want to update your openssl because you have security concerns based upon the apparent version number then you need to read up on and understand about backporting. RHEL (upstream for CentOS) backport security fixes into their products. You can use the command

rpm -q --changelog openssl

to look at the changelog. You should then check to see that the vulnerabilities you are concerned about are listed, they almost certainly will be.

For reference the C7.3 system I have to hand 

openssl version
OpenSSL 1.0.1e-fips 11 Feb 2013

and

rpm -q --changelog openssl 

 Thu Sep 22 2016 Tomáš Mráz <[email protected]> 1.0.1e-60
- fix CVE-2016-2177 - possible integer overflow
- fix CVE-2016-2178 - non-constant time DSA operations
- fix CVE-2016-2179 - further DoS issues in DTLS
- fix CVE-2016-2180 - OOB read in TS_OBJ_print_bio()
- fix CVE-2016-2181 - DTLS1 replay protection and unprocessed records issue
- fix CVE-2016-2182 - possible buffer overflow in BN_bn2dec()
- fix CVE-2016-6302 - insufficient TLS session ticket HMAC length check
- fix CVE-2016-6304 - unbound memory growth with OCSP status request
- fix CVE-2016-6306 - certificate message OOB reads
- mitigate CVE-2016-2183 - degrade all 64bit block ciphers and RC4 to 
  112 bit effective strength
...

So as recently as September security fixes were backported into OpenSSL.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .