I am running a server with CentOS 6.5, patched to recent openssl updates via yum update ssl
and with indications the current version indeed has the patch to the vulnerability.
$ sudo rpm -q --changelog openssl | grep CVE-2014-0224
- fix CVE-2014-0224 fix that broke EAP-FAST session resumption support
- fix CVE-2014-0224 - SSL/TLS MITM vulnerability
However, a QUALYS lab scan (https://www.ssllabs.com/ssltest) indicates I'm vulnerable
This server is vulnerable to the OpenSSL CCS vulnerability (CVE-2014-0224) and exploitable. Grade set to F.
I'm at a loss - should I trust QUALYS or the centos distro and rpm flag? If not the distro, this should get raised with centos - my past bug reports on their site have languished - if this is serious, how to get real attention?
Note: we always restart all relevant services after patches.