Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm currently running Ubuntu 13.10 and my OpenSSL version is 1.0.1e. As per latest security warning, I'd like to upgrade it to 1.0.1h.

I've tried apt-get upgrade openssl (don't want to upgrade everything) and apt-get install openssl but it doesn't work. The result of OpenSSL version is the same, OpenSSL 1.0.1e 11 Feb 2013 (The date is the important bit).

How can I upgrade to 1.0.1h (preferably without having to compile it)?

share|improve this question
1  
Note that if you don't upgrade everything, check to make sure that relevant things (your mail server, etc) don't have openssl linked statically (i.e., compiled in), which is very possibly the case on Ubuntu. If you know an application uses ssl but ldd does not show a link to either libssl or libgnutls then you need to find out if libssl was compiled in, and if so, upgrade the app itself. Again: this was the case on a Ubuntu 12.04 I work with. –  goldilocks Jun 9 at 12:42

1 Answer 1

up vote 4 down vote accepted

Ubuntu 13.10 is a supported branch of Ubuntu, which means it receives critical security updates for all packages.

The openssl package you have installed is not a vanilla openssl v1.0.1e, but v1.0.1e-3ubuntu1.4 as you can see in the package's profile.

The -3ubuntu1.4 part means the package has been modified by the maintainer for some reasons (perhaps security patches from upstream versions).

If you now look at the changelog of this specific maintainer-created version, you will see that all issues that have been found since the v1.0.1e was realeased are in deed fixed in this maintainer-created version.

Long story short, your openssl package is up-to-date from the security point of view, so you do not need to update.

share|improve this answer
    
in that case, why the date hasn't changed? Also, would be possible to make apt-get to force upgrade to 1.0.1h? –  WagnerMatosUK Jun 9 at 12:44
2  
@WagnerMatosUK What dates are you referring to? v1.0.1e-3ubuntu1.4 has been released on June 2, 2014. And no you can not force update, because that version is simply not available on the updates channel of your Ubuntu. Once again, you most likely do not need to do that anyway. The maintainer's new version is just as secure. –  SkyDan Jun 9 at 12:46
    
The date I'm referring to is the one displayed when I do a openssl version I get this message: OpenSSL 1.0.1e 11 Feb 2013 What is this date referring to? How can I be certain no further updates are required? The reason I'm being a pain in the back side is that I need to demonstrate to the client... –  WagnerMatosUK Jun 9 at 12:52
    
@WagnerMatosUK This command returns the version that was hard coded in the sources by the original developers. You can check the package's version with dpkg -l | grep openssl. –  SkyDan Jun 9 at 12:58
    
When I do a dpkg -l | grep openssl it doesn't return the date it has been update. Are you certain no further upgrades are required? –  WagnerMatosUK Jun 9 at 13:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.