I am running a server with CentOS 6.5, patched to recent openssl updates via yum update ssl and with indications the current version indeed has the patch to the vulnerability.

$ sudo rpm -q --changelog openssl | grep CVE-2014-0224
- fix CVE-2014-0224 fix that broke EAP-FAST session resumption support
- fix CVE-2014-0224 - SSL/TLS MITM vulnerability

However, a QUALYS lab scan (https://www.ssllabs.com/ssltest) indicates I'm vulnerable

This server is vulnerable to the OpenSSL CCS vulnerability (CVE-2014-0224) and exploitable. Grade set to F.

I'm at a loss - should I trust QUALYS or the centos distro and rpm flag? If not the distro, this should get raised with centos - my past bug reports on their site have languished - if this is serious, how to get real attention?

Note: we always restart all relevant services after patches.

  • 2
    is there a load balancer or any other system between qualys and your patched server that might be causing the finding? redirected ports?
    – schroeder
    Mar 7, 2015 at 6:14
  • 1
    In addition to checking the items @schroeder mentioned, do you possibly have a service using a statically linked version of OpenSSL, rather than the OS version?
    – Xander
    Mar 7, 2015 at 14:15
  • @Xander I thought about that, and believe that may be the issue. Am investigating. Mar 9, 2015 at 1:44
  • @Xander - I have verified all openssl libraries are patched. Both nessus and ssllabs, however, report we are vulnerable. Jul 4, 2015 at 22:18
  • @schroeder nope - the server I am referring to is the front end that gets hit first. Jul 4, 2015 at 22:19

1 Answer 1


If openssl was patched recently and you have not restarted all services which are using libssl you may have to reboot your machine in order to complete the openssl patching.

By running following command you can see what services are using libssl:

lsof | grep -i libssl | grep DEL | awk '{print $1}' | sort | uniq

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.