Comments on How to find out if your server is affected from Openssl Heartbleed vulnerability (CVE-2014-0160) and how to fix that
How to find out if your server is affected from Openssl Heartbleed vulnerability (CVE-2014-0160) and how to fix that A severe vulnerability in OpenSSL has been found, the vulnerability is named Heartbleed and affects the heartbeat implementation in Openssl version 1.0.1 up to version 1.0.1f. This velnerability can be used to get the private key of a SSL connection, so it is important to update the server immediately. The bug is fixed in OpenSSL 1.0.1g. All Major Linux Distributions have release updates to the vulnerability.
8 Comment(s)
Comments
You don't always get the real version with "openssl version".
Try "apt-cache policy openssl".
openssl 1.0.1e in centos has been fixed.
The only thing you have to do is: yum update
It will automatically download and update a backported version of openssl-1.0.1e-16.el6_5.7 which has been patched by RedHat with heartbeat disabled.
To verify the update, check the changelog:
# rpm -q --changelog openssl-1.0.1e | grep -B 1 CVE-2014-0160
you should see the following:
* Mon Apr 07 2014 Tomáš Mráz <[email protected]> 1.0.1e-16.7 - fix CVE-2014-0160 - information disclosure in TLS heartbeat extension
Hey, Thanks for that. It worked!
* Tue Jan 07 2014 Tomáš Mráz <[email protected]> 1.0.1e-16.4
- fix CVE-2013-4353 - Invalid TLS handshake crash
>>> Run the command: openssl version to get the version number of openssh. <<< No, this will get you the vn of openssl. Don't drag OpenSSH into this, OpenSSH is not affected.
Thanks for pointing out this typo. I corrected it in the tutorial.
Hello,
I think that if you have a server up and running (in my case Ubuntu 12.04) apt-get update && apt-get upgrade is not the best way since you have other services that is a little dangerous to update.
You can only apt-get update &&apt-get install openssl libssl1.0.0
Don't forget to restart server. This worked fine for me!
Please be aware that this fixes the openssl issue but leaves other issues open. So better check if you can not install all pending security updates. If your server is eetup correctly, then ubuntu maintennace and security updates should not cause any problems.