Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

This question already has an answer here:

It looks like Ubuntu Server 14.04 just released today includes OpenSSL v1.0.1f which is vulnerable to the heartbleed bug.

I've updated my packages (apt-get update) but that's the latest version available.

How to do I upgrade to 1.0.1g so I'm not vulnerable?

share|improve this question

marked as duplicate by Braiam, Rinzwind, Aditya, Radu Rădeanu, Mitch Apr 17 at 21:14

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2  
Please read the security notice. It does NOT list 14.04 –  Rinzwind Apr 17 at 19:05

1 Answer 1

The package in Ubuntu 14.04 is not vulnerable. It includes the patch to fix the issue, rather than a newer version. See from the changelog:

openssl (1.0.1f-1ubuntu2) trusty; urgency=medium

  * SECURITY UPDATE: side-channel attack on Montgomery ladder implementation
    - debian/patches/CVE-2014-0076.patch: add and use constant time swap in
      crypto/bn/bn.h, crypto/bn/bn_lib.c, crypto/ec/ec2_mult.c,
      util/libeay.num.
    - CVE-2014-0076
  * SECURITY UPDATE: memory disclosure in TLS heartbeat extension
    - debian/patches/CVE-2014-0160.patch: use correct lengths in
      ssl/d1_both.c, ssl/t1_lib.c.
    - CVE-2014-0160
share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.