2

I have openssl 1.0.1e installed but its seems to be buggy based on this But when I list out the updates for the system it doesn't list out 1.0.1q as suggested on above link.

Any idea how to install through yum or by compiling?

Installed Packages
openssl.x86_64                                                                1:1.0.1e-51.el7_2.2                                                                 @updates
7

You don't need to upgrade or compile anything.

The document you reference state that you should update from 1.0.1 to 1.0.1q because of CVE-2015-3194, CVE-2015-3195 and CVE-2105-3196. However, if you run:

rpm -q --changelog openssl | grep CVE-2015-319

you should get:

- fix CVE-2015-3194 - certificate verify crash with missing PSS parameter
- fix CVE-2015-3195 - X509_ATTRIBUTE memory leak
- fix CVE-2015-3196 - race condition when handling PSK identity hint

which means that these fixed have been retrospectively applied to your version of openSSL.

Distros don't update their versions on every time upstream release, as these releases are relatively new and untested. Instead they cherry-pick the patches that they will apply. Usually, this means security patches or regression fixes only.

  • 1
    Beat me to it... FWIW, here's the pertinent Centos-announce post and Redhat annoucement – Ulrich Schwarz Feb 11 '16 at 7:44
  • rpm -q --changelog openssl | grep CVE-2015-319 Ouput of this is nothing on my server so i guess i donot have updated version ?? Then how do i update – pkm Feb 11 '16 at 7:49
  • sudo yum update openssl should do it. – garethTheRed Feb 11 '16 at 7:51
  • "No Packages marked for Update" – pkm Feb 11 '16 at 7:53
  • 1
    @pkm: as I linked above, -42 incorporates redhat erratum CESA/RHSA-2015-2617 which fixes CVE-2015-3194, -3195, -3196. – Ulrich Schwarz Feb 11 '16 at 11:49
0

yum update openssl issue, I was getting this following error while trying to update openssl:

Loaded plugins: product-id, refresh-packagekit, rhnplugin, security, subscription-manager

There was an error communicating with RHN. RHN Satellite or RHN Classic support will be disabled. Error communicating with server.

The message was:

Error Class Code: 6001

Error Class Info: RHN is in the process of being decommissioned and systems are no longer able to receive updates or make use of any RHN services. Please see https://access.redhat.com/articles/2979901 for more info.

Setting up Update Process

Could not retrieve mirrorlist https://mirrors.iuscommunity.org/mirrorlist?repo=ius-el6&arch=x86_64&protocol=http

error was 14: Peer cert cannot be verified or peer cert invalid

Error: Cannot retrieve repository metadata (repomd.xml) for repository: ius. Please verify its path and try again.

I got the solution for error code 6001. Here is the summery which resolved that issue:

mv /etc/yum.repos.d/* /tmp/
rm -rf /var/cache/yum/*
yum clean all
yum repolist
yum update openssl
yum list installed openssl

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.