1

I upgrade OpenSSL 1.0.1p

lsof | grep libssl

The result

firewalld   665           root  mem       REG              253,0    445544  805308545 /usr/lib64/libssl.so.1.0.1e
gmain       665  1197     root  mem       REG              253,0    445544  805308545 /usr/lib64/libssl.so.1.0.1e
tuned       670           root  mem       REG              253,0    445544  805308545 /usr/lib64/libssl.so.1.0.1e
gmain       670   859     root  mem       REG              253,0    445544  805308545 /usr/lib64/libssl.so.1.0.1e
tuned       670   860     root  mem       REG              253,0    445544  805308545 /usr/lib64/libssl.so.1.0.1e
tuned       670   861     root  mem       REG              253,0    445544  805308545 /usr/lib64/libssl.so.1.0.1e
tuned       670   862     root  mem       REG              253,0    445544  805308545 /usr/lib64/libssl.so.1.0.1e
NetworkMa   890           root  mem       REG              253,0    260456  805308647 /usr/lib64/libssl3.so
NetworkMa   890  1085     root  mem       REG              253,0    260456  805308647 /usr/lib64/libssl3.so
gdbus       890  1088     root  mem       REG              253,0    260456  805308647 /usr/lib64/libssl3.so
sshd       1450           root  mem       REG              253,0    260456  805308647 /usr/lib64/libssl3.so
pickup    13721        postfix  DEL       REG              253,0            806585326 /usr/lib64/libssl.so.1.0.0
sshd      14032           root  mem       REG              253,0    260456  805308647 /usr/lib64/libssl3.so
opendkim  25549       opendkim  DEL       REG              253,0            806585326 /usr/lib64/libssl.so.1.0.0
opendkim  25549 25550 opendkim  DEL       REG              253,0            806585326 /usr/lib64/libssl.so.1.0.0
opendkim  25549 25551 opendkim  DEL       REG              253,0            806585326 /usr/lib64/libssl.so.1.0.0
master    25654           root  DEL       REG              253,0            806585326 /usr/lib64/libssl.so.1.0.0
qmgr      25656        postfix  DEL       REG              253,0            806585326 /usr/lib64/libssl.so.1.0.0
tlsmgr    25662        postfix  DEL       REG              253,0            806585326 /usr/lib64/libssl.so.1.0.0 

I remove libssl.so.1.0.1e, libcrypto.so.1.0.1e, libcrypto.so.10 and make symbolic link

libssl.so.1.0.1e    to  libssl.so.1.0.0

libcrypto.so.1.0.1e to  libcrypto.so.1.0.0

libcrypto.so.10     to  libcrypto.so.1.0.0

lsof | grep libssl

firewalld   659           root  mem       REG              253,0         0  806585325 /usr/lib64/libssl.so.1.0.0
gmain       659  1265     root  mem       REG              253,0         0  806585325 /usr/lib64/libssl.so.1.0.0
tuned       664           root  mem       REG              253,0         0  806585325 /usr/lib64/libssl.so.1.0.0
gmain       664   840     root  mem       REG              253,0         0  806585325 /usr/lib64/libssl.so.1.0.0
tuned       664   841     root  mem       REG              253,0         0  806585325 /usr/lib64/libssl.so.1.0.0
tuned       664   842     root  mem       REG              253,0         0  806585325 /usr/lib64/libssl.so.1.0.0
tuned       664   851     root  mem       REG              253,0         0  806585325 /usr/lib64/libssl.so.1.0.0
NetworkMa   886           root  mem       REG              253,0    260456  805308647 /usr/lib64/libssl3.so
NetworkMa   886  1035     root  mem       REG              253,0    260456  805308647 /usr/lib64/libssl3.so
gdbus       886  1044     root  mem       REG              253,0    260456  805308647 /usr/lib64/libssl3.so
opendkim   1510       opendkim  mem       REG              253,0         0  806585325 /usr/lib64/libssl.so.1.0.0
opendkim   1510  1518 opendkim  mem       REG              253,0         0  806585325 /usr/lib64/libssl.so.1.0.0
opendkim   1510  1519 opendkim  mem       REG              253,0         0  806585325 /usr/lib64/libssl.so.1.0.0
sshd       2667           root  mem       REG              253,0    260456  805308647 /usr/lib64/libssl3.so
sshd      16899           root  mem       REG              253,0    260456  805308647 /usr/lib64/libssl3.so
lsof | grep libcry
firewalld   659           root  mem       REG              253,0   2226059  806585322 /usr/lib64/libcrypto.so.1.0.0
gmain       659  1265     root  mem       REG              253,0   2226059  806585322 /usr/lib64/libcrypto.so.1.0.0
tuned       664           root  mem       REG              253,0   2226059  806585322 /usr/lib64/libcrypto.so.1.0.0
gmain       664   840     root  mem       REG              253,0   2226059  806585322 /usr/lib64/libcrypto.so.1.0.0
tuned       664   841     root  mem       REG              253,0   2226059  806585322 /usr/lib64/libcrypto.so.1.0.0
tuned       664   842     root  mem       REG              253,0   2226059  806585322 /usr/lib64/libcrypto.so.1.0.0
tuned       664   851     root  mem       REG              253,0   2226059  806585322 /usr/lib64/libcrypto.so.1.0.0
ntpd        720            ntp  mem       REG              253,0   2226059  806585322 /usr/lib64/libcrypto.so.1.0.0
opendkim   1510       opendkim  mem       REG              253,0   2226059  806585322 /usr/lib64/libcrypto.so.1.0.0
opendkim   1510  1518 opendkim  mem       REG              253,0   2226059  806585322 /usr/lib64/libcrypto.so.1.0.0
opendkim   1510  1519 opendkim  mem       REG              253,0   2226059  806585322 /usr/lib64/libcrypto.so.1.0.0
sshd       2667           root  mem       REG              253,0     40816  805307655 /usr/lib64/libcrypt-2.17.so
sshd       2667           root  mem       REG              253,0   2226059  806585322 /usr/lib64/libcrypto.so.1.0.0
sshd      16899           root  mem       REG              253,0     40816  805307655 /usr/lib64/libcrypt-2.17.so
sshd      16899           root  mem       REG              253,0   2226059  806585322 /usr/lib64/libcrypto.so.1.0.0

But ssh has problem

the error message:

ssh: /lib64/libcrypto.so.10: no version information available (required by ssh)
ssh: /lib64/libcrypto.so.10: no version information available (required by ssh)
ssh: /lib64/libcrypto.so.10: no version information available (required by ssh)
  • What distribution are you using? How did you upgrade OpenSSL? Did you restart sshd after the OpenSSL upgrade? – mjturner Jul 17 '15 at 6:51
  • Distribution: 3.10.0-123.el7.x86_64 #1 SMP Mon May 5 11:16:57 EDT 2014 x86_64 x86_64 x86_64 GNU/Linux Upgrade: complied the source. I have restarted the sshd. If the sshd use libcrypto.so.1.0.1e, there is no any error – David07172015 Jul 17 '15 at 7:52
1

You should NEVER upgrade a core system component on a package based distribution from source. No, really, NEVER. Doing so causes exactly the problem you have described.

To fix it:

  1. Completely remove the OpenSSL you installed from source and put all of the links back that existed before. You system will now be in the state before you did the update.
  2. Install a correctly packaged version of OpenSSL from an RPM package. I see the official CentOS 7 OpenSSL package is still 1.0.1e (see here) but are you sure the fixes you want haven't been included in that package? Version numbers are sometimes misleading - Red Hat very often updates packages to newer releases/backports fixes but keeps the package major version the same.

    You can use the following to check:

    rpm -q --changelog openssl | less
    

    I can't see any OpenSSL packages for CentOS 7 in EPEL but there are third party packages available. I'd be hesitant to trust a third part repository for OpenSSL though...

  • Thank you. I would like to fix "CVE-2015-1793", but openssl-1.0.1e-42.el7.9.x86_64.rpm doesn't fix this issue, only 1.0.1p can fix it. I tried to run "make uninstall" to remove Oepnssl, but it failed. It shows "No rule to make target uninstall'. Stop" If my server only can upgrade from rpm, I will wait the update. – David07172015 Jul 20 '15 at 7:06
  • Neither CentOS 7 nor RHEL 7 are vulnerable to CVE-2015-1793. See Red Hat's advisory for more information. As you have OpenSSL 1.0.1e you are not vulnerable - only releases 1.0.2c, 1.0.2b, 1.0.1n and 1.0.1o are (see OpenSSL advisory). – mjturner Jul 20 '15 at 7:10
  • Thank you, How to remove openssl? I tried to run "make uninstall" to remove Oepnssl, but it failed. It shows "No rule to make target uninstall'. Stop" – David07172015 Jul 20 '15 at 7:46
  • You're going to have to remove it manually - rm all the files that you installed, etc. It may be a good idea to reinstall the OpenSSL RPM afterwards to make sure all of the symlinks, etc are correctly back in place. – mjturner Jul 20 '15 at 7:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.