I was reading the Heartbleed vulnerability in the OpenSSL and in its official website, they have a list which mentioned that
version 1.0.1 to 1.0.1f are affected, as shown in below pic.
I have CentOS 6 installed in my server and updated as per latest available versions in
redhat release -
[root@SERVER ~]# cat /etc/redhat-release
CentOS release 6.8 (Final)
uname output -
[root@SERVER ~]# uname -a
Linux SERVER 2.6.32-504.16.2.el6.x86_64 #1 SMP Wed Apr 22 06:48:29 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
Now, when i am checking for OpenSSL version, it shows me the below information -
[root@SERVER ~]# openssl version
OpenSSL 1.0.1e-fips 11 Feb 2013
So, in version output, i am able to see that version is 1.0.1e which is affected with
Heartbleed Vulnerability and it also shows me that version was last updated on
11 Feb 2013.
I have following doubts --
- Does this means all the CentOS 6 machines are affected with Heartbleed ?
- RedHat is not providing patches for CentOS ?
- What should i do now ? Manually install the latest OpenSSL package OR migrate to CentOS 7 (although i am not sure whether CentOS 7 contains updated packages or not) ?