1

I have a CentOS 6.6 system. When I type into command line openssl version, the system gives me OpenSSL 1.0.1e-fips 11 Feb 2013. When I type yum update openssl, then yum says No Packages marked for Update.

With this information I assume, that OpenSSL on my system is up to date. But when looking to https://openssl.org/, there seems to be a more actual version.

So the question is: Why has my system an old OpenSSL version, when there are newer versions?

  • I would want to find out if that was compiled DOPENSSL_NO_HEARTBEATS. If not and you are running a public facing server, you probably want to downgrade to 1.0.0 or install a newer version from source. en.wikipedia.org/wiki/Heartbleed – goldilocks Jun 23 '15 at 12:14
2

Cent OS is based on Red Hat Enterprise Linux and the main goal of a distribution produced for enterprise customers is to provide robust, stable and reliable OS and system software.

Major releases usually contain recent but established versions of current software. Subsequent minor releases will contain packages with minor updates of that software.

However, they won’t have updates of software which has major revisions, i.e., their update packages only contain minor enhancements that shouldn’t cause any compatibility issues.

In your case:

  • 6 is the major release
  • 6.6 is the minor release

When Red Hat released version 6 of their Enterprise Linux, they chose version 1.0.0 for OpenSSL but over the course of the minor updates to RHEL 6.6, they upgraded to version 1.0.1e. This page details the updates to the Red Hat OpenSSL package for the minor releases of RHEL 6.

While newer versions of the upstream software will contain bug fixes included with the enhanced features, Red Hat backport the fixes and patch bugs in their packages so that their customers can benefit from the latest upstream security fixes while retaining stability and compatibility with their other software packages.

From Backporting Security Fixes

Backporting has a number of advantages for customers, but it can create confusion when it is not understood. Customers need to be aware that just looking at the version number of a package will not tell them if they are vulnerable or not. For example, stories in the press may include phrases such as "upgrade to Apache httpd 2.0.43 to fix the issue," which only takes into account the upstream version number. This can cause confusion as even after installing updated packages from a vendor, it is not likely customers will have the latest upstream version. They will instead have an older upstream version with backported patches applied.

Also, some security scanning and auditing tools make decisions about vulnerabilities based solely on the version number of components they find. This results in false positives as the tools do not take into account backported security fixes.

See also What's the difference between a major, minor, and asynchronous release?.

0

While its not the latest version, RHEL/CentOS will backport changes in newer versions of the OpenSSL source to the version you are using on your CentOS 6 box currently.

In regards to why CentOS isn't using the very latest version. This could be for various reasons including:

  • Dependencies
  • Stability
  • Compatibility

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.