1

I was reading the Heartbleed vulnerability in the OpenSSL and in its official website, they have a list which mentioned that version 1.0.1 to 1.0.1f are affected, as shown in below pic.

enter image description here

I have CentOS 6 installed in my server and updated as per latest available versions in yum repository.

redhat release -
[root@SERVER ~]# cat /etc/redhat-release CentOS release 6.8 (Final)

uname output -
[root@SERVER ~]# uname -a Linux SERVER 2.6.32-504.16.2.el6.x86_64 #1 SMP Wed Apr 22 06:48:29 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux

Now, when i am checking for OpenSSL version, it shows me the below information -
[root@SERVER ~]# openssl version OpenSSL 1.0.1e-fips 11 Feb 2013

So, in version output, i am able to see that version is 1.0.1e which is affected with Heartbleed Vulnerability and it also shows me that version was last updated on 11 Feb 2013.

I have following doubts --

  1. Does this means all the CentOS 6 machines are affected with Heartbleed ?
  2. RedHat is not providing patches for CentOS ?
  3. What should i do now ? Manually install the latest OpenSSL package OR migrate to CentOS 7 (although i am not sure whether CentOS 7 contains updated packages or not) ?
  • plz update your server kernel also :P – 8zero2.ops Oct 25 '16 at 10:49
  • Already there in uname -a output – Gaurav Kansal Oct 25 '16 at 10:51
  • sorry , i mean to say update it with latest kernel if possible – 8zero2.ops Oct 25 '16 at 10:51
  • as per yum, everything (including packages and kernel) all are updated up to latest version. – Gaurav Kansal Oct 25 '16 at 10:53
2

Most distributors don't just upgrade to the latest version of OpenSSL since this could have unintended side effects (slightly different behavior or even new bugs). Instead they just backport the patch and keep the version number. This means you should not only look at the openssl version but at the distributors version number to.

For CentOS 6.8 this is currently OpenSSL 1.0.1e but vendor release 48.el6_8.3. This release includes all recent bugfixes and also the fix for Heartbleed:

* Mon Apr 07 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-23
  - fix CVE-2014-0160 - information disclosure in TLS heartbeat extension
  • Interesting thing. Instead they just backport the patch -- Is this means that redhat copy and paste the code from OpenSSL or write its own code for every vulnerability ? – Gaurav Kansal Oct 28 '16 at 17:43
  • 1
    @GauravKansal: This depends. If the original code in question is about the same in the old and the new version then one could often simply apply the diff as patch, maybe slightly modified. In other cases one need to write new code which fixes the problem in the old version in a different way. – Steffen Ullrich Oct 28 '16 at 17:49
  • Thanks for explanation. This must be a tough task to simply understand the old code, write a new one for each and every vulnerability AND do this for every package (like OpenSSL, BIND and many more). – Gaurav Kansal Oct 28 '16 at 17:51
  • 1
    @GauravKansal: yes, it is time consuming. But the alternative would be to customers force to always use the latest greatest and most untested code :( – Steffen Ullrich Oct 28 '16 at 18:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.