Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

It looks like Ubuntu Server 14.04 just released today includes OpenSSL v1.0.1f which is vulnerable to the heartbleed bug.

I've updated my packages (apt-get update) but that's the latest version available.

How to do I upgrade to 1.0.1g so I'm not vulnerable?

share|improve this question

marked as duplicate by Braiam, Rinzwind, Aditya, Radu Rădeanu, Mitch Apr 17 '14 at 21:14

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Please read the security notice. It does NOT list 14.04 – Rinzwind Apr 17 '14 at 19:05

The package in Ubuntu 14.04 is not vulnerable. It includes the patch to fix the issue, rather than a newer version. See from the changelog:

openssl (1.0.1f-1ubuntu2) trusty; urgency=medium

  * SECURITY UPDATE: side-channel attack on Montgomery ladder implementation
    - debian/patches/CVE-2014-0076.patch: add and use constant time swap in
      crypto/bn/bn.h, crypto/bn/bn_lib.c, crypto/ec/ec2_mult.c,
    - CVE-2014-0076
  * SECURITY UPDATE: memory disclosure in TLS heartbeat extension
    - debian/patches/CVE-2014-0160.patch: use correct lengths in
      ssl/d1_both.c, ssl/t1_lib.c.
    - CVE-2014-0160
share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.