I am using Linux Mint for one of my servers and have been trying to find out if the Linux Mint Debian Edition(LMDE) has updated their repositories with patches for the OpenSSL bug.

I have a different pure Debian server and Debian was quick to remedy the problem. However, after running an update on my LMDE system the the OpenSSL package version was the same as the compromised versions.

Is there a LMDE patch for the OpenSSL libraries?

  • 3
    This question appears to be off-topic because it is about Mint patches, and would be more appropriate on the Unix & Linux site. – Xander Apr 9 '14 at 18:58
  • I think, you might be right about that. However, it is specifically about a security and this Heartbleed exploit, so it's probably straddling the boundaries between both sites. – Dodzi Dzakuma Apr 10 '14 at 0:08

I am running LMDE as a workstation and I am afraid as of now (Wed Apr 9 11:28:14 UTC 2014) no patch has been released yet. All available patches have been applied by me and right now # openssl version -a shows OpenSSL 1.0.1e 11 Feb 2013.

You might want to consider changing your sources to point to Debian repos directly in order to get the update. I'll be doing this soon.

Just as a side note, LMDE is a desktop- rather than server-targeted distro. If you wish to be secure you should rather stick to Debian stable.

EDIT If you wish to update the package please follow the steps:

  1. Edit your /etc/apt/sources.list file, comment out whatever you have there and add the following line: deb http://ftp.us.debian.org/debian testing main contrib non-free (Note: you might just as well do this with apt-pinning but this way it's easier to go back to LMDE repos right after the update)
  2. aptitude update
  3. aptitude install openssl libssl1.0.0 to update the packages
  4. aptitude show openssl to verify you have 1.0.1g-1 version (see here for explanation of version number)
  5. Edit your /etc/apt/sources.list again, uncomment what you previously had there and comment out the deb http://ftp.us.debian.org/debian testing main contrib non-free line.
  6. aptitude update and you're good to go :)
  • Sorry, i cannot comment to Erathiels' post yet but i would like to mention that you could also only add the security repository of Debian testing. See debian.org/security/faq#testing If that works you would not need to remove all the standard LMDE repos. – Stefan Apr 9 '14 at 18:18
  • Regarding Stefan's answer below (I can't comment on other people's posts yet): yes, you could do that and in theory in should work. However, it did not, I've tried that and no openssl update was available. You could figure that out using apt-pinning but I decided to go (and show) the simplest way. – Erathiel Apr 10 '14 at 8:10

Not the answer you're looking for? Browse other questions tagged or ask your own question.