Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have openssl 1.0.1e installed but its seems to be buggy based on this But when I list out the updates for the system it doesn't list out 1.0.1q as suggested on above link.

Any idea how to install through yum or by compiling?

Installed Packages
openssl.x86_64                                                                1:1.0.1e-51.el7_2.2                                                                 @updates
share|improve this question
up vote 5 down vote accepted

You don't need to upgrade or compile anything.

The document you reference state that you should update from 1.0.1 to 1.0.1q because of CVE-2015-3194, CVE-2015-3195 and CVE-2105-3196. However, if you run:

rpm -q --changelog | grep CVE-2015-319

you should get:

- fix CVE-2015-3194 - certificate verify crash with missing PSS parameter
- fix CVE-2015-3195 - X509_ATTRIBUTE memory leak
- fix CVE-2015-3196 - race condition when handling PSK identity hint

which means that these fixed have been retrospectively applied to your version of openSSL.

Distros don't update their versions on every time upstream release, as these releases are relatively new and untested. Instead they cherry-pick the patches that they will apply. Usually, this means security patches or regression fixes only.

share|improve this answer
1  
Beat me to it... FWIW, here's the pertinent Centos-announce post and Redhat annoucement – Ulrich Schwarz Feb 11 at 7:44
    
rpm -q --changelog openssl | grep CVE-2015-319 Ouput of this is nothing on my server so i guess i donot have updated version ?? Then how do i update – pkm Feb 11 at 7:49
    
sudo yum update openssl should do it. – garethTheRed Feb 11 at 7:51
    
"No Packages marked for Update" – pkm Feb 11 at 7:53
1  
@pkm: as I linked above, -42 incorporates redhat erratum CESA/RHSA-2015-2617 which fixes CVE-2015-3194, -3195, -3196. – Ulrich Schwarz Feb 11 at 11:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.