I have set up a test web server on CentOS 7 to find a way to fix Padding Oracle vulnerability, which I got when I scanned our production site on ssllabs.com. On the test server, I installed openssl(1.0.2j, which is latest as of 1/12/2017) and apache(2.4.25, which is also latest as of 1/12/2017) from source and made some basic changes to apache configuration such as SSL. After making sure SSL works by accessing it with a web browser, I scanned the test site on ssllabs.com, which told me that it still had the same vulnerability. I thought the test site would pass it because the bug was already fixed at the release of 1.0.2h according to the Openssl official site. I have no idea what else to try next. Any advice would be appreciated.

I think the apache uses the openssl I installed instead of the other one (1.0.1e), which is built in on CentOS7. Below is one of what I did to make sure of that.

Under the condition of ServerTokens Full

[root@*** ~]# curl --head http://***.*********.com
HTTP/1.1 200 OK
Date: Thu, 12 Jan 2017 19:52:31 GMT
Server: Apache/2.4.25 (Unix) OpenSSL/1.0.2j
Last-Modified: Mon, 11 Jun 2007 18:53:14 GMT
ETag: "2d-432a5e4a73a80" 
Accept-Ranges: bytes
Content-Length: 45
Content-Type: text/html

marked as duplicate by Michael Hampton Jan 12 '17 at 21:30

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • What padding oracle vulnerability? Why haven't you just installed the distribution updates? – Michael Hampton Jan 12 '17 at 20:58
  • I wish I could just use yum to install them. I used to do that way, but I have to keep updating them to clear PCI compliance, so this is the only way I can think of so far. I didn't know that vulnerability until I got it when I scanned our website. If you want to know the detail, this is the link to the explanation (I tried to read it, but it was too hard for me to understand..). blog.cloudflare.com/… – masa Jan 12 '17 at 21:27
  • Your OS distribution updates are sufficient for PCI compliance. – Michael Hampton Jan 12 '17 at 21:29
  • Ok. I will try that. I started installing them from source when I was using CentOS 6 and I haven't tried yum on CentOS 7 yet. So it's worth a try. But the main point of my question is that what part of software/configuration the vulnerability is coming from. Actually our PCI compliance scan does not catch this vulnerability. I realized it when I happened to scan from ssllabs.com. So I don't know how serious it is, but our site was rated F on the site, which I think is really bad. I am trying to find out what is causing it. – masa Jan 12 '17 at 21:47