1

I've got a problem when I upgraded my OpenSSL on RHEL 6.5. The OpenSSL is missing the library libcrypto.so.10. Instead the openssl 1.0.1j created lib is libcrypto.so.1.0.0. I've made a soft link, but it still does not work for other packages using libcrypto.so.10.

Does anyone have experience on this problem?

Explanation (addendum/edit): this is required info since many will be looking to use the 1.0.1j version directly from the OpenSSL package to escape the latest (2014.10.15) "POODLE" vulnerability in OpenSSL. If you get the tar.gz file from openssl.org at this time, you should not have a problem. There previously was a problem for a short time and that publication may still exist on other sites, so avoid taking down the file other than at openssl.org: openssl downloads.

Please read through the SSL3 warning in the @jvp answer regarding RPM's since the updates do not completely solve server problems that arise when servers permit such connections. a discussion of this additional vulnerability can be found at: ncas division of us-cert.gov

See the answer regarding using Red Hat based RPM's for EL6 and EL7.

Look to your /usr/lib directory for 32-bit and /usr/lib64 for 64 bit and the layout should be as follows:

  • libcrypto.a
  • libcrypto.so -> libcrypto.so.1.0.1j
  • libcrypto.so.10 -> libcrypto.so.1.0.1j
  • libcrypto.so.1.0.1j
  • .libcrypto.so.1.0.1j.hmac
  • .libcrypto.so.10.hmac -> .libcrypto.so.1.0.1j.hmaclibssl.a
  • libssl.so -> libssl.so.1.0.1j
  • libssl.so.10 -> libssl.so.1.0.1j
  • libssl.so.1.0.1j
  • .libssl.so.1.0.1j.hmac
  • .libssl.so.10.hmac -> .libssl.so.1.0.1j.hmac

There are also the lib sub-directories openssl and package, but these have never been a problem.

  • 1
    By which means did you update OpenSSL? An official update from RHEL? A third party RPM? By doing 'make install?? – Sami Laine Sep 20 '14 at 18:22
  • Very likely it should be libcrypto.so.1, not libcrypto.so.10. – peterph Sep 20 '14 at 19:00
2

The RPM's are out for RHEL [6|7] and siblings (i.e., CentOS et al.) and available via yum at most repositories.

Please note that these RPM's address a portion of the "POODLE" vulnerabilities per:

  • CVE-2014-3567,
  • CVE-2014-3566, and
  • CVE-2014-3513

SEE: cert.gov

The security update does not address some specific SSLv3 problems, so those with servers being updated must remove any possibility of clients connecting using this protocol and -- specifically -- CBC methods.

Removing SSL3 from server config's is really easy to do by:

NGINX/TENGINE:

  • add/replace ssl_protocols TLSv1 TLSv1.1 TLSv1.2; in the http config section and
  • make certain that the 'ssl_protocols' directive is not over-ridden in any server sections.

If you find any server directives, just remove them and let 'HTTP' govern ... as it should anyway.

APACHE:

  • add/replace SSLProtocol All -SSLv2 -SSLv3 in the global SSL configuration section and
  • as with Nginx, check your vhosts.

As with previous OpenSSL snafus, instead of issuing new RPM numbers to match the updated OpenSSL version number (1.0.1j), the .rpm has a patch back-ported to the last extent .rpm of the distro; which is 1.0.1e (for RHEL-based distros) and is fully versioned — as of this moment — as 1.0.1e-30.[variable by specific machine version].

So, taking CentOS 6 64-bit as an example, the .rpm you will get is openssl-1.0.1e-30.el6_5.2.x86_64.rpm.

As with any OpenSSL update, anything that relies upon OpenSSL such as web servers, VPN's, and the like must be restarted on the server before the update will come into play.

  • As @jvp said, openssl-1.0.1e-30.el6_5.2 on CentOS 6.5 adds support for TLS_FALLBACK_SCSV So a simple yum update openssl should be sufficient in applying the patch on CentOS. Source: lists.centos.org/pipermail/centos-announce/2014-October/… - Granted the updated was probably not applicable around the time of the original post. – fyrye Nov 26 '14 at 14:20
0
wget http://www.openssl.org/source/openssl-1.0.1j.tar.gz
tar -xvf openssl-1.0.1j.tar.gz
cd openssl-1.0.1j
./config --prefix=/usr no-threads shared
make
make test
make install

openssl version
  • 2
    That's not great advice IMO, better to stick to vendor-provided packages. Also, please put some explanation about what this does and why it will fix hungwar's problem. – Mat Oct 15 '14 at 18:41
  • Yes, this is the solution manual for the standard configuration of apache or DirectAdmin with Apache or Litespeed - Centos 6+,7 Still no updates are available on the CentOS for fix openssl – HitMe.pl Oct 15 '14 at 19:38
  • 1
    A fix for what OpenSSL issue? – Mat Oct 15 '14 at 20:14
  • The OpenSSL 1.0.1j, 1.0.0o, and 0.9.8zc packages add support for TLS_FALLBACK_SCSV This allows applications to block the ability for a MITM attacker to force a protocol downgrade. eg POODLE – fyrye Nov 26 '14 at 13:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.