2

This link talks about the new patches to be released by OpenSSL Foundation very soon.

It says:

In a mailing list note published last night, Matt Caswell of the OpenSSL Project Team announced that OpenSSL versions 1.0.2a, 1.0.1m, 1.0.0r, and 0.9.8zf will be released Thursday.

Does it mean that all the 1.0.0, 1.0.2 and 0.9.8 versions has to be updated? Our openssl version is 1.0.1. Should I wait for 1.0.1m to be released and apply the patch?

[root@merc07 ~]# openssl version
OpenSSL 1.0.1e-fips 11 Feb 2013
[root@merc07 ~]#

closed as off-topic by M'vy, Xander, SPRBRN, Stephane, Eric G Mar 19 '15 at 16:53

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    You should definitely update your OpenSSL package. – RoraΖ Mar 19 '15 at 13:12
  • @raz Thank you. Just wanted to confirm and plan it. – Sree Mar 19 '15 at 13:13
  • 2
    I'm voting to close this question as off-topic because the question is already answer and will be out-dated in hours. – M'vy Mar 19 '15 at 14:19
1

Yes. You should always run the latest version of code (assuming it doesn't break a critical system supported by an earlier version, in which case... good luck!).

1

You're running a version of OpenSSL provided by your Linux distribution. They will provide an update incorporating those security fixes, backported to the version you currently have. All you need to do is to install the updates (e.g. yum update) when they become available.

Not the answer you're looking for? Browse other questions tagged or ask your own question.