1

I was reading the Heartbleed vulnerability in the OpenSSL and in its official website, they have a list which mentioned that version 1.0.1 to 1.0.1f are affected, as shown in below pic.

enter image description here

I have CentOS 6 installed in my server and updated as per latest available versions in yum repository.

redhat release -
[root@SERVER ~]# cat /etc/redhat-release CentOS release 6.8 (Final)

uname output -
[root@SERVER ~]# uname -a Linux SERVER 2.6.32-504.16.2.el6.x86_64 #1 SMP Wed Apr 22 06:48:29 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux

Now, when i am checking for OpenSSL version, it shows me the below information -
[root@SERVER ~]# openssl version OpenSSL 1.0.1e-fips 11 Feb 2013

So, in version output, i am able to see that version is 1.0.1e which is affected with Heartbleed Vulnerability and it also shows me that version was last updated on 11 Feb 2013.

I have following doubts --

  1. Does this means all the CentOS 6 machines are affected with Heartbleed ?
  2. RedHat is not providing patches for CentOS ?
  3. What should i do now ? Manually install the latest OpenSSL package OR migrate to CentOS 7 (although i am not sure whether CentOS 7 contains updated packages or not) ?
Improve this question
4
  • plz update your server kernel also :P
    – Arjun sharma
    Oct 25, 2016 at 10:49
  • Already there in uname -a output
    – Gaurav Kansal
    Oct 25, 2016 at 10:51
  • sorry , i mean to say update it with latest kernel if possible
    – Arjun sharma
    Oct 25, 2016 at 10:51
  • as per yum, everything (including packages and kernel) all are updated up to latest version.
    – Gaurav Kansal
    Oct 25, 2016 at 10:53

1 Answer 1

Reset to default
2

Most distributors don't just upgrade to the latest version of OpenSSL since this could have unintended side effects (slightly different behavior or even new bugs). Instead they just backport the patch and keep the version number. This means you should not only look at the openssl version but at the distributors version number to.

For CentOS 6.8 this is currently OpenSSL 1.0.1e but vendor release 48.el6_8.3. This release includes all recent bugfixes and also the fix for Heartbleed:

* Mon Apr 07 2014 Tomáš Mráz <[email protected]> 1.0.1e-23
  - fix CVE-2014-0160 - information disclosure in TLS heartbeat extension
Improve this answer
4
  • Interesting thing. Instead they just backport the patch -- Is this means that redhat copy and paste the code from OpenSSL or write its own code for every vulnerability ?
    – Gaurav Kansal
    Oct 28, 2016 at 17:43
  • 1
    @GauravKansal: This depends. If the original code in question is about the same in the old and the new version then one could often simply apply the diff as patch, maybe slightly modified. In other cases one need to write new code which fixes the problem in the old version in a different way.
    – Steffen Ullrich
    Oct 28, 2016 at 17:49
  • Thanks for explanation. This must be a tough task to simply understand the old code, write a new one for each and every vulnerability AND do this for every package (like OpenSSL, BIND and many more).
    – Gaurav Kansal
    Oct 28, 2016 at 17:51
  • 1
    @GauravKansal: yes, it is time consuming. But the alternative would be to customers force to always use the latest greatest and most untested code :(
    – Steffen Ullrich
    Oct 28, 2016 at 18:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .