This server is vulnerable to the OpenSSL Padding Oracle vulnerability (CVE-2016-2107) and insecure. Grade set to F

Question

I am verifying my domain name with SSL LABS and got Grade F

and i got this message

This server is vulnerable to the OpenSSL Padding Oracle vulnerability (CVE-2016-2107) and insecure. Grade set to F.

i am using Ubuntu and implemented following steps:-

**sudo apt-get update && sudo apt-get upgrade**

and following steps

1. sudo apt-get install make (Install compiling library Make)
2. wget https://www.openssl.org/source/openssl-1.0.2g.tar.gz
3. tar -xzvf openssl-1.0.2g.tar.gz
4. cd openssl-1.0.2g
5. sudo ./config
6. sudo make install
7. sudo ln -sf /usr/local/ssl/bin/openssl which openssl

after this i run this command openssl version -v and i got the result OpenSSL 1.0.2g 1 Mar 2016

Any idea why i am getting this **OpenSSL oracle padding vulnerability (CVE-2016-2107) issue?** My ubuntu version is

Distributor ID: Ubuntu
Description:    Ubuntu 14.04.5 LTS
Release:        14.04

Thanks in advance.

Answer 1

You are getting that result because you are using a vulnerable version of OpenSSL... if you check the OpenSSL Vulnerabilities page (search on page for 2107 to find this CVE), you'll see that it's not fixed until OpenSSL 1.0.2h. 1.0.2g is vulnerable. Why would you choose to wget 1.0.2g, anyhow? The current version of the 1.0.2 branch is 1.0.2j, which was released in late September.

If you're asking why the Ubuntu 14.04 repo has a dangerously outdated version of OpenSSL, I can only offer two responses:

1. You're using Ubuntu, which in my experience is not very good about backporting software to older versions (yes, even LTS versions). Once they cross the 24-month line, they drop you like a hot rock.
2. Your version of Ubuntu is 2.5 years old, and you should have moved to 16.04 (or 16.10).

OpenSSL 1.0.2h came out two months after 1.0.2g, and in that time crossed out of the two-year support window for the 14.04 Ubuntu build, so they stopped caring about it. Ubuntu 16.04 or 16.10 should be fine, or any distro that backports security fixes for more than two years (which, admittedly, not many do).

To upgrade, use the command sudo do-release-upgrade (see this page for more info) from the command line. LTS (Long-Term Support) builds will only upgrade to new LTS builds. The upgrade itself will take a while, but afterwards you will be running Ubuntu 16.04 and have access to its repositories. This will let you keep your software updated, at least until the support period for that version ends in another 17 months.

After upgrading, you should run sudo apt-get update && sudo apt-get upgrade again, to make sure all your packages are up to date.

Answer 2

Assuming you use Apache as a webserver, then the library responisble for doing the TLS handling is /usr/lib/apache2/modules/mod_ssl.so, which is still there and linked to the systemwide installed openssl library.

You either have to recompile mod_ssl, too or, preferrably, just update your openssl packages which should have the security fix (like @Aria has alread pointed out in her comment)