1

I was reading the Heartbleed vulnerability in the OpenSSL and in its official website, they have a list which mentioned that version 1.0.1 to 1.0.1f are affected, as shown in below pic.

enter image description here

I have CentOS 6 installed in my server and updated as per latest available versions in yum repository.

redhat release -
[root@SERVER ~]# cat /etc/redhat-release CentOS release 6.8 (Final)

uname output -
[root@SERVER ~]# uname -a Linux SERVER 2.6.32-504.16.2.el6.x86_64 #1 SMP Wed Apr 22 06:48:29 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux

Now, when i am checking for OpenSSL version, it shows me the below information -
[root@SERVER ~]# openssl version OpenSSL 1.0.1e-fips 11 Feb 2013

So, in version output, i am able to see that version is 1.0.1e which is affected with Heartbleed Vulnerability and it also shows me that version was last updated on 11 Feb 2013.

I have following doubts --

  1. Does this means all the CentOS 6 machines are affected with Heartbleed ?
  2. RedHat is not providing patches for CentOS ?
  3. What should i do now ? Manually install the latest OpenSSL package OR migrate to CentOS 7 (although i am not sure whether CentOS 7 contains updated packages or not) ?
4
  • plz update your server kernel also :P Oct 25, 2016 at 10:49
  • Already there in uname -a output Oct 25, 2016 at 10:51
  • sorry , i mean to say update it with latest kernel if possible Oct 25, 2016 at 10:51
  • as per yum, everything (including packages and kernel) all are updated up to latest version. Oct 25, 2016 at 10:53

1 Answer 1

2

Most distributors don't just upgrade to the latest version of OpenSSL since this could have unintended side effects (slightly different behavior or even new bugs). Instead they just backport the patch and keep the version number. This means you should not only look at the openssl version but at the distributors version number to.

For CentOS 6.8 this is currently OpenSSL 1.0.1e but vendor release 48.el6_8.3. This release includes all recent bugfixes and also the fix for Heartbleed:

* Mon Apr 07 2014 Tomáš Mráz <[email protected]> 1.0.1e-23
  - fix CVE-2014-0160 - information disclosure in TLS heartbeat extension
4
  • Interesting thing. Instead they just backport the patch -- Is this means that redhat copy and paste the code from OpenSSL or write its own code for every vulnerability ? Oct 28, 2016 at 17:43
  • 1
    @GauravKansal: This depends. If the original code in question is about the same in the old and the new version then one could often simply apply the diff as patch, maybe slightly modified. In other cases one need to write new code which fixes the problem in the old version in a different way. Oct 28, 2016 at 17:49
  • Thanks for explanation. This must be a tough task to simply understand the old code, write a new one for each and every vulnerability AND do this for every package (like OpenSSL, BIND and many more). Oct 28, 2016 at 17:51
  • 1
    @GauravKansal: yes, it is time consuming. But the alternative would be to customers force to always use the latest greatest and most untested code :( Oct 28, 2016 at 18:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .