2

I'm currently running Ubuntu 13.10 and my OpenSSL version is 1.0.1e. As per latest security warning, I'd like to upgrade it to 1.0.1h.

I've tried apt-get upgrade openssl (don't want to upgrade everything) and apt-get install openssl but it doesn't work. The result of OpenSSL version is the same, OpenSSL 1.0.1e 11 Feb 2013 (The date is the important bit).

How can I upgrade to 1.0.1h (preferably without having to compile it)?

1
  • 1
    Note that if you don't upgrade everything, check to make sure that relevant things (your mail server, etc) don't have openssl linked statically (i.e., compiled in), which is very possibly the case on Ubuntu. If you know an application uses ssl but ldd does not show a link to either libssl or libgnutls then you need to find out if libssl was compiled in, and if so, upgrade the app itself. Again: this was the case on a Ubuntu 12.04 I work with.
    – goldilocks
    Commented Jun 9, 2014 at 12:42

1 Answer 1

4

Ubuntu 13.10 is a supported branch of Ubuntu, which means it receives critical security updates for all packages.

The openssl package you have installed is not a vanilla openssl v1.0.1e, but v1.0.1e-3ubuntu1.4 as you can see in the package's profile.

The -3ubuntu1.4 part means the package has been modified by the maintainer for some reasons (perhaps security patches from upstream versions).

If you now look at the changelog of this specific maintainer-created version, you will see that all issues that have been found since the v1.0.1e was realeased are in deed fixed in this maintainer-created version.

Long story short, your openssl package is up-to-date from the security point of view, so you do not need to update.

7
  • in that case, why the date hasn't changed? Also, would be possible to make apt-get to force upgrade to 1.0.1h? Commented Jun 9, 2014 at 12:44
  • 2
    @WagnerMatosUK What dates are you referring to? v1.0.1e-3ubuntu1.4 has been released on June 2, 2014. And no you can not force update, because that version is simply not available on the updates channel of your Ubuntu. Once again, you most likely do not need to do that anyway. The maintainer's new version is just as secure. Commented Jun 9, 2014 at 12:46
  • The date I'm referring to is the one displayed when I do a openssl version I get this message: OpenSSL 1.0.1e 11 Feb 2013 What is this date referring to? How can I be certain no further updates are required? The reason I'm being a pain in the back side is that I need to demonstrate to the client... Commented Jun 9, 2014 at 12:52
  • @WagnerMatosUK This command returns the version that was hard coded in the sources by the original developers. You can check the package's version with dpkg -l | grep openssl. Commented Jun 9, 2014 at 12:58
  • When I do a dpkg -l | grep openssl it doesn't return the date it has been update. Are you certain no further upgrades are required? Commented Jun 9, 2014 at 13:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .