Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am running Debian Wheezy. I have just upgraded my system and should have the latest version of openssl (1.0.1g which fixes a critical bug), but it does not appear to be being used.

I have run:

apt-get update
apt-get upgrade

dpkg -s openssl shows: Version: 1.0.1e-2+deb7u5

openssl version shows: OpenSSL 1.0.1e 11 Feb 2013

I have rebooted my system since upgrading. What do I need to do to get openssl using the updated version?

share|improve this question
    
See also How do I recover from the Heartbleed bug in OpenSSL? (which touches on this concern, but buried in a bigger answer). –  Gilles Apr 8 at 19:11

2 Answers 2

Per the Debian bug tracker, the Heartbleed issue was updated in version 1.0.1e-2+deb7u5:

Marked as fixed in versions 1.0.1e-2+deb7u5. Request was from Salvatore Bonaccorso to control@bugs.debian.org. (Mon, 07 Apr 2014 21:45:14 GMT) Full text and rfc822 format available.

As such, you're running the updated version and are no longer vulnerable.

Source: https://bugs.debian.org/743883

This is common practice: Debian applied the security fix to the version that was already in the distribution.

share|improve this answer
    
Thanks for the clarification. So it's normal for the command openssl version to still report the same as it was previously? I guess I expected that would change. –  user51279 Apr 8 at 0:54
    
I agree that openssl version reporting the same as before isn't particularly helpful. –  Dave Lesser Apr 8 at 1:42
    
If you have doubts, you can check for the vulnerability using filippo.io/Heartbleed –  David Wilkins Apr 8 at 19:26
    
@user51279 run openssl version -b and you can see the updated build date. –  burmat Apr 9 at 16:50

The upstream version is 1.0.1e, which is what is being shown. What is the problem? Note the 2+deb7u5 after the dash is Debian-specific.

share|improve this answer
2  
Because 1.0.1g is the latest upstream version at this time, and a lot of people are paying attention because of a highly publicized security vulnerability. Debian followed their practice of backporting security fixes, which isn't immediately obvious to people who aren't used to this practice. –  Gilles Apr 8 at 19:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.