1

I'm attempting to ensure that we are using the most recent openssl version on Centos 6.5, and yum reports that we are, but openssl continues to report that its version is an older one:

[vagrant@centos-65-developer ~]$ sudo yum list openssl
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
 * base: mirror.trouble-free.net
 * extras: mirrors.gigenet.com
 * rpmforge: fr2.rpmfind.net
 * updates: centos.sonn.com
Installed Packages
openssl.x86_64                      1.0.1e-16.6_5.7                   @updates

Available Packages
openssl.i686                        1.0.1e-16.el6_5.7                 updates

[vagrant@centos-65-developer ~]$ openssl version -a
OpenSSL 1.0.1e-fips 11 Feb 2013
built on: Tue Apr  8 02:39:29 UTC 2014
platform: linux-x86_64
options:  bn(64,64) md2(int) rc4(16x,int) des(idx,cisc,16,int) idea(int) blowfish(idx)
compiler: gcc -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DKRB5_MIT -m64 -DL_ENDIAN -DTERMIO -Wall -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic -Wa,--noexecstack -DPURIFY -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM
OPENSSLDIR: "/etc/pki/tls"
engines:  dynamic

Does Centos' openssl always report incorrectly, or is this machine truly running the old version (1.0.1e-fips)?

1
  • You can also see that your openssl was built yesterday ("Tue Apr 8 02:39:29 UTC 2014"), so you really have the most recent package. Most probably, CentOS, similar to other distributors, just patched the 1.0.1e release instead of pushing an upgrade to 1.0.1g.
    – Dubu
    Apr 9, 2014 at 17:45

2 Answers 2

1

I might be mistaken but what I see is the same version ?

you have openssl.x86_64 1.0.1e-16.6_5.7 installed

and your openssl reports the same version : OpenSSL 1.0.1e-fips 11 Feb 2013

4
  • You're not looking at the whole version. Yum reports 1.0.1e-16.6_5.7 and openssl reports 1.0.1e-fips.
    – Schlueter
    Apr 9, 2014 at 15:42
  • 1
    1.0.1e is the openssl version, the rest is the RPM specific release version. If you look at the openssl site, you can see that's their version naming convention: 4459777 Feb 11 16:34:23 2013 openssl-1.0.1e.tar.gz The latest for example is : 4509047 Apr 7 19:21:29 2014 openssl-1.0.1g.tar.gz rpm.org states : name-version-release.architecture.rpm is the format so in this case -16.el6_5.7 is the release and not the actual version ( 1.0.1e )
    – Moti
    Apr 9, 2014 at 16:43
  • Okay, cool, between this and the build time, I'm confident in the update. The reason I was concerned was because the rpm release 16.6_5.7 is a patched version of openssl for the heartbleed bug, but is still the same openssl version as the prior, broken version, release 16.e16_5.4.
    – Schlueter
    Apr 9, 2014 at 18:09
  • Yep, based on this : lists.centos.org/pipermail/centos-announce/2014-April/… you should be totally fine.
    – Moti
    Apr 9, 2014 at 19:35
0

The difference is in the architecture under which the openssl package was built. The i686 and x86_64 can coexist peacefully, but make sure you at least have one that matches your machine: uname -i works to be sure.

Anyway, if you're using YUM, install the openssl.i686 one exactly by name if you want to keep the RPMdb happy. The thing is, you probably got the older i686 build installed as part of your initial install (you installed by ISO?) and got an arch you didn't need.

You could uninstall the one you don't need too, if you like, but to satisfy dependencies now, just install the one exactly by name that it wants, and move on.

1
  • The issue was the build version, not the architecture. I manually ran yum update openssl to get the current version, and openssl's version reporting threw me off.
    – Schlueter
    Apr 11, 2014 at 19:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .