1

I am verifying my domain name with SSL LABS and got Grade F

and i got this message

This server is vulnerable to the OpenSSL Padding Oracle vulnerability (CVE-2016-2107) and insecure. Grade set to F.

i am using Ubuntu and implemented following steps:-

**sudo apt-get update && sudo apt-get upgrade**

and following steps

  1. sudo apt-get install make (Install compiling library Make)
  2. wget https://www.openssl.org/source/openssl-1.0.2g.tar.gz
  3. tar -xzvf openssl-1.0.2g.tar.gz
  4. cd openssl-1.0.2g
  5. sudo ./config
  6. sudo make install
  7. sudo ln -sf /usr/local/ssl/bin/openssl which openssl

after this i run this command openssl version -v and i got the result OpenSSL 1.0.2g 1 Mar 2016

Any idea why i am getting this **OpenSSL oracle padding vulnerability (CVE-2016-2107) issue?** My ubuntu version is

Distributor ID: Ubuntu
Description:    Ubuntu 14.04.5 LTS
Release:        14.04

Thanks in advance.

  • 1
    try sudo apt-get install --only-upgrade libssl1.0.0 openssl – Aria Nov 8 '16 at 7:23
  • OpenSSL 1.0.2g 1 Mar 2016. this is my updated version. – Ankita Kashyap Nov 8 '16 at 7:57
  • libssl1.0.0 is already the newest version. openssl is already the newest version. – Ankita Kashyap Nov 8 '16 at 7:59
  • Have you tried running the above command? – Aria Nov 8 '16 at 8:05
  • 1
    You also have to restart your webserver after updating openssl (if in doubt, reboot the whole server) – Josef Nov 8 '16 at 8:39
3

You are getting that result because you are using a vulnerable version of OpenSSL... if you check the OpenSSL Vulnerabilities page (search on page for 2107 to find this CVE), you'll see that it's not fixed until OpenSSL 1.0.2h. 1.0.2g is vulnerable. Why would you choose to wget 1.0.2g, anyhow? The current version of the 1.0.2 branch is 1.0.2j, which was released in late September.

If you're asking why the Ubuntu 14.04 repo has a dangerously outdated version of OpenSSL, I can only offer two responses:

  1. You're using Ubuntu, which in my experience is not very good about backporting software to older versions (yes, even LTS versions). Once they cross the 24-month line, they drop you like a hot rock.
  2. Your version of Ubuntu is 2.5 years old, and you should have moved to 16.04 (or 16.10).

OpenSSL 1.0.2h came out two months after 1.0.2g, and in that time crossed out of the two-year support window for the 14.04 Ubuntu build, so they stopped caring about it. Ubuntu 16.04 or 16.10 should be fine, or any distro that backports security fixes for more than two years (which, admittedly, not many do).

To upgrade, use the command sudo do-release-upgrade (see this page for more info) from the command line. LTS (Long-Term Support) builds will only upgrade to new LTS builds. The upgrade itself will take a while, but afterwards you will be running Ubuntu 16.04 and have access to its repositories. This will let you keep your software updated, at least until the support period for that version ends in another 17 months.

After upgrading, you should run sudo apt-get update && sudo apt-get upgrade again, to make sure all your packages are up to date.

  • Do i need to update ubuntu ? – Ankita Kashyap Nov 8 '16 at 8:37
  • 1
    Yes, you do. You could backport and install a newer build of OpenSSL manually - like I said, I don't understand why you grabbed 1.0.2g when there are newer versions available - but you'd just keep having that problem. You are on an unsupported OS version that no longer reliably gets security updates. I'll add instructions on upgrading. – CBHacking Nov 8 '16 at 10:29
  • What you are saying is not correct. Ubuntu 14.04 is an LTS release and is getting security updates for 5 years (that is until 2019). The openssl in that Ubuntu version has that bug fixed, so there is no need to do a release upgrade just for the sake of it. – mat Nov 8 '16 at 16:30
  • i updated to OpenSSL 1.0.2h. Still getting same issue – Ankita Kashyap Nov 9 '16 at 2:49
0

Assuming you use Apache as a webserver, then the library responisble for doing the TLS handling is /usr/lib/apache2/modules/mod_ssl.so, which is still there and linked to the systemwide installed openssl library.

You either have to recompile mod_ssl, too or, preferrably, just update your openssl packages which should have the security fix (like @Aria has alread pointed out in her comment)

  • i am not usign apache – Ankita Kashyap Nov 8 '16 at 8:36
  • What webserver are you using? – mat Nov 8 '16 at 15:01
  • i am using nodejs... – Ankita Kashyap Nov 9 '16 at 2:47
  • Oh. Can't really help you with that, sorry. But I assume, that your problem is similar to the one I described. There is probably some library in nodejs doing the SSL stuff which is linked to your system libssl instead of your manually installed one. – mat Nov 9 '16 at 13:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.