OpenSSL Padding Oracle vulnerability (CVE-2016-2107) + Nginx

Question

I was trying Qualys SSL Labs test and It told me that the server is vulnerable to OpenSSL Padding Oracle vulnerability (CVE-2016-2107). I googled around on how to fix this, and although the OpenSSL version installed on my system (Ubuntu 14.04) should be patched for that according to this link I was still getting this error.

I tried upgrading OpenSSL but it was already the newest version, so I installed manually a newer version following the instructions here which went fine, but that didn't fix anything. Looking at the info from Nginx, It seems it still runs with the previous version:

nginx -V
nginx version: nginx/1.10.2
built with OpenSSL 1.0.1f 6 Jan 2014 (running with OpenSSL 1.0.2g-fips 1 Mar 2016)

while OpenSSL has clearly been updated:

openssl version
OpenSSL 1.0.2j 26 Sep 2016

Any idea how to get all this sorted out?

Note that yes, I did restart Nginx, I even tried sudo service nginx upgrade and even rebooted the server.

Answer 1

You need to build ngnix with the openSSL 1.0.1f version

The configure command might look like this:

./configure --with-http_ssl_module --with-openssl=/path/to/openssl 1.0.1f