1

This question already has an answer here:

I'm currently using Linux Mint 17.3.

Today I realized that the repos only provide the OpenSSL in version 1.0.1f. But only version >= 1.0.1g has the https://en.wikipedia.org/wiki/Heartbleed Bug fixed.

Can this be a problem? So is there a way that someone reads from my memory by sending a manipulated Heartbeat request? Or is this only the case when I'm running a server providing HTTPS access? How would a susceptible setup look like (e.g. Apache Server with module XYZ and setting abc)

Or is Linux Mint deliberately made insecure?

marked as duplicate by Steffen Ullrich, techraf, Xander, Matthew, wireghoul Aug 12 '16 at 8:29

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    To add to Steffen's point, Mint is Ubuntu based, which is in turn Debian based. Debian does not update the version number of packages, but instead updates the build number, and the builds may well include backported security updates, despite only containing features corresponding to the displayed version number. – Matthew Aug 11 '16 at 15:57
  • But if the build was vulnerable, it would also affect clients using the SSL library? (So, the server can also send heartbeats to clients?) – Edward Aug 11 '16 at 16:03
  • Yes. But it was fixed years ago, so... – Matt Nordhoff Aug 11 '16 at 16:25
  • @MattNordhoff : just to be sure: with it was fixed years ago you mean the fix for the heartbleed bug from April 7, 2014? – Edward Aug 11 '16 at 22:46
  • 2
    @Edward Debian and Ubuntu immediately backported the patch to the OpenSSL packages on every supported version. You can run apt-get changelog openssl and scroll down to 07 Apr 2014 or search for CVE-2014-0160, or apt-get source openssl and look at the file openssl-*/debian/patches/CVE-2014-0160.patch itself. I assume Mint is roughly the same. – Matt Nordhoff Aug 11 '16 at 23:13

Browse other questions tagged or ask your own question.