Open source implementation of the Secure Socket Layer (SSL) and Transport Layer Security (TLS) protocols

learn more… | top users | synonyms

133
votes
6answers
94k views

How to patch the Heartbleed bug (CVE-2014-0160) in OpenSSL?

As of today, a bug in OpenSSL has been found affecting versions 1.0.1 through 1.0.1f (inclusive) and 1.0.2-beta. Since Ubuntu 12.04, we are all vulnerable to this bug. In order to patch this ...
11
votes
1answer
3k views

How to patch Ubuntu EOL for Heartbleed / cve-2014-0160? [closed]

I still have an Ubuntu 13.04 Raring Ring server that I am running. I need to patch it for Heartbleed / cve-2014-0160 bug, but Canical no longer is supporting it. What do I do? References: ...
4
votes
2answers
4k views

Is Ubuntu 14.04 secure against heart bleed bug [duplicate]

I have read that there is a bug in SSL called heart bleed bug. Has Ubuntu 14.04 shipped along with this bug or has it been resolved in this release?
3
votes
2answers
1k views

OpenSSL remains vulnerable after update to 14.04

We have an AWS server running OpenVPN which was built using Ubuntu 13.10. After the announcement of the Heartbleed vulnerability, we updated the server. This morning, we upgraded the server to 14.04. ...
9
votes
0answers
8k views

Am I affected? Heartbleed bug [duplicate]

I've just learned about the Heartbleed Bug (OpenSSL leaking private keys), and based on the website, heartbleed.com, it says that OpenSSL 1.0.1 through version f is affected. However it leaves off ...
0
votes
1answer
102 views

Override Distro Package with Custom Package?

Ubuntu 12.04 LTS provides OpenSSL 1.0.1e, but it disables TLSv1.1 and TLSv1.2. In the past it was an interop decision because of broken client implementations. In 2014, its really not appropriate ...
11
votes
3answers
36k views

Upgrade OpenSSL on Ubuntu 12.04

I wanted to upgrade OpenSSL to 1.0.1 on an Ubuntu 12.04 system. I have noticed that an apt-get upgrade openssl does not end up upgrading OpenSSL. Is the newer OpenSSL supported on Ubuntu? I have also ...
10
votes
2answers
10k views

Patch OpenSSL CVE-2014-0160 on ubuntu 12.04?

NO, this is not a duplicate of How to patch the Heartbleed bug (CVE-2014-0160) in OpenSSL?. So, read on. I am seeing conflicting information with respect to Ubuntu 12.04: The Heartbleed page claims ...
5
votes
4answers
5k views

Enabling SSL in MySQL

I'm running Ubuntu Server 12.04, and I want to enable SSL connections to MySQL. I've generated the following keys/certs files with OpenSSL: ca-cert.pem server-cert.pem server-key.pem I stored ...
1
vote
1answer
296 views

Which TLS protocols are enabled in Ubuntu 14.04's OpenSSL?

This is a follow up to Override Distro Package with Custom Package?. Does anyone know if Ubuntu 14.04's OpenSSL enables all TLS protocols (TLS1.0, TLS1.1 and TLS1.2)? Or does it have protocols ...
8
votes
1answer
895 views

Is there a modern and clear tutorial on setting up SSL for localhost / testing use?

Let's say I'm developing a script for login.example.com. I have absolutely no access to login.example.com, but that page loads a script on assets.example.com (which I have access to). To test how ...
4
votes
3answers
3k views

How to patch the Vulnerability [CVE-2014-0224] in OpenSSL?

I've received a warning from the authority that generated my certificate, it says that there is bug in OpenSSL and it has been found affecting versions 1.0.1. As I understand, I have to upgrade to ...
11
votes
3answers
2k views

How to enable TLS 1.2 in Nginx?

How do I enable TLS 1.1 and 1.2 for SSL connections in my Ubuntu 12.04 server? I am using the following version of nginx and openssl library. $ ./nginx -v nginx version: nginx/1.2.3 $ openssl ...
0
votes
0answers
80 views

How do I upgrade openssl? [duplicate]

I am running Ubuntu 12.04 LTS and would like to upgrade openssl to the latest version. openssl version -a reports "1.0.1 14 Mar 2012" I ran apt-get update / upgrade / dist-upgrade but it says "0 ...