OpenSSL Security Advisory: TLS heartbeat read overrun

Re:OpenSSL Security Advisory: TLS heartbeat read overrun by zrail on Monday April 07, 2014 @04:44PM (#7549342)

How does one go about installing this update on Ubuntu? "sudo apt-get upgrade openssl" didn't do it.

[ Parent | on HN ]

Re:OpenSSL Security Advisory: TLS heartbeat read overrun by Andys on Monday April 07, 2014 @06:29PM (#7550055)

The fix has now been released by Ubuntu, so you can upgrade via the normal methods (apt-get update && apt-get upgrade)

[ Parent | on HN ]

Re:OpenSSL Security Advisory: TLS heartbeat read overrun by specto on Monday April 07, 2014 @10:09PM (#7551027)

Make sure you check running daemons too... apt-get install debian-goodies; checkrestart

[ Parent | on HN ]

Re:OpenSSL Security Advisory: TLS heartbeat read overrun by vajorie on Monday April 07, 2014 @04:50PM (#7549388)

By either compiling & installing it with -DOPENSSL_NO_HEARTBEATS or waiting for the security fix to be backported by ubuntu devs. http://heartbleed.com/

[ Parent | on HN ]

Re:OpenSSL Security Advisory: TLS heartbeat read overrun by rlpb on Tuesday April 08, 2014 @07:14AM (#7552638)

See: http://www.ubuntu.com/usn/usn-2165-1/

The binary package name is "libssl1.0.0". You want "sudo apt-get update && sudo apt-get install libssl1.0.0", but I suggest that you take all security and regular updates (or set sources.list to security only updates if you insist). Then you can just run "sudo apt-get update && sudo apt-get dist-upgrade" to pick up all updates, without worrying about package names.

If you want to verify if a particular vulnerability is fixed, look in /usr/share/doc/<package>/changelog.Debian.gz. In this case, you want /usr/share/doc/libssl1.0.0/changelog.Debian.gz. In this file, you'll see CVE-2014-0160 mentioned as fixed, which is the universal identifier of this vulnerability.

[ Parent | on HN ]