I have an old Debian 3.1 (kernel 2.4.19) where the version of ssl is

$ openssl version
OpenSSL 0.9.8c 05 Sep 2006

I read that there was some issue about random generator being guessable.


But then it seems that the version I use is not vulnerable because it is just before the change. Or is there a way to verify this? Should I try and upgrade OpenSSL regardless of it being vulnerable or not?

1 Answer 1


Probably vulnerable.

CVEDetails has a list of 49 vulnerabilities for that version.

Take your pick.

Also: Debian 3.1 has had no security updates for nine years.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.