2

I was trying Qualys SSL Labs test and It told me that the server is vulnerable to OpenSSL Padding Oracle vulnerability (CVE-2016-2107). I googled around on how to fix this, and although the OpenSSL version installed on my system (Ubuntu 14.04) should be patched for that according to this link I was still getting this error.

I tried upgrading OpenSSL but it was already the newest version, so I installed manually a newer version following the instructions here which went fine, but that didn't fix anything. Looking at the info from Nginx, It seems it still runs with the previous version:

nginx -V
nginx version: nginx/1.10.2
built with OpenSSL 1.0.1f 6 Jan 2014 (running with OpenSSL 1.0.2g-fips 1 Mar 2016)

while OpenSSL has clearly been updated:

openssl version
OpenSSL 1.0.2j 26 Sep 2016

Any idea how to get all this sorted out?

Note that yes, I did restart Nginx, I even tried sudo service nginx upgrade and even rebooted the server.

1

You need to build ngnix with the openSSL 1.0.1f version

The configure command might look like this:

./configure --with-http_ssl_module --with-openssl=/path/to/openssl 1.0.1f

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.