Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Background
I am using Linux Mint for one of my servers and have been trying to find out if the Linux Mint Debian Edition(LMDE) has updated their repositories with patches for the OpenSSL bug.

I have a different pure Debian server and Debian was quick to remedy the problem. However, after running an update on my LMDE system the the OpenSSL package version was the same as the compromised versions.

Question
Is there a LMDE patch for the OpenSSL libraries?

share|improve this question

closed as off-topic by Iszi, Xander, tylerl, Noordung, Eric G Apr 10 at 2:08

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Iszi, tylerl
If this question can be reworded to fit the rules in the help center, please edit the question.

3  
This question appears to be off-topic because it is about Mint patches, and would be more appropriate on the Unix & Linux site. –  Xander Apr 9 at 18:58
    
I think, you might be right about that. However, it is specifically about a security and this Heartbleed exploit, so it's probably straddling the boundaries between both sites. –  Dodzi Dzakuma Apr 10 at 0:08

1 Answer 1

up vote 8 down vote accepted

I am running LMDE as a workstation and I am afraid as of now (Wed Apr 9 11:28:14 UTC 2014) no patch has been released yet. All available patches have been applied by me and right now # openssl version -a shows OpenSSL 1.0.1e 11 Feb 2013.

You might want to consider changing your sources to point to Debian repos directly in order to get the update. I'll be doing this soon.

Just as a side note, LMDE is a desktop- rather than server-targeted distro. If you wish to be secure you should rather stick to Debian stable.

EDIT If you wish to update the package please follow the steps:

  1. Edit your /etc/apt/sources.list file, comment out whatever you have there and add the following line: deb http://ftp.us.debian.org/debian testing main contrib non-free (Note: you might just as well do this with apt-pinning but this way it's easier to go back to LMDE repos right after the update)
  2. aptitude update
  3. aptitude install openssl libssl1.0.0 to update the packages
  4. aptitude show openssl to verify you have 1.0.1g-1 version (see here for explanation of version number)
  5. Edit your /etc/apt/sources.list again, uncomment what you previously had there and comment out the deb http://ftp.us.debian.org/debian testing main contrib non-free line.
  6. aptitude update and you're good to go :)
share|improve this answer
    
Sorry, i cannot comment to Erathiels' post yet but i would like to mention that you could also only add the security repository of Debian testing. See debian.org/security/faq#testing If that works you would not need to remove all the standard LMDE repos. –  Stefan Apr 9 at 18:18
    
Regarding Stefan's answer below (I can't comment on other people's posts yet): yes, you could do that and in theory in should work. However, it did not, I've tried that and no openssl update was available. You could figure that out using apt-pinning but I decided to go (and show) the simplest way. –  Erathiel Apr 10 at 8:10

Not the answer you're looking for? Browse other questions tagged or ask your own question.