5

The 1.0.1 version is currently only receiving security bug fixes and all support will be discontinued for this version on 31st December 2016. <Link> as stated in their website.

OpenSSL is installed from the main repository of Ubuntu by default during installation.

As ubuntu 14.04 has long term support. So, should I expect upgraded version of OpenSSL or should we have to upgrade it by ourselves.

Improve this question
3
  • Good question, 16.04 runs on 10.0.2 but i cant tell you anything about 14.04 so maybe heres a canonical answer needed.
    – Videonauth
    Dec 22, 2016 at 12:48
  • 3
    The Security team will most likely be continuing to backport critical fixes for OpenSSL to older versions for the lifespan of Trusty. The Security team is usually very good at this.
    – Thomas Ward ♦
    Dec 22, 2016 at 12:51
  • Launchpad Bug #1474541 says: debian/patches/0001-Support-openssl-1.0.2b-and-above.patch: handle the case where we can't get the issuer certificate, which typically happens after 1.0.2b; but it appears that 1.0.1f includes that check too, which fails in sbsigntool.
    – Arijit Chatterjee
    Dec 22, 2016 at 12:53

2 Answers 2

Reset to default
4

The answer to your question appears to be that security updates will be released (backported) as needed through the duration of Trusty LTS support. There are currently no plans to release openssl 1.0.2 for Trusty. According to the posts here only security patches will be released for 1.01 after 2016-12-31. It seems the latest source available is 1.0.1e available here

Why?

Marc Deslauriers (Ubuntu Security Engineer) states: "Ubuntu doesn't typically update to newer software versions. Like most other Linux distros, we backport security patches to the versions of software we ship, whether or not there is still upstream support for it."

So the commitment to security is there.

If you feel the need to upgrade regardless you can obtain the source on this page and compile it yourself. Installation instructions are included in the archive but it's pretty straight forward even if you've never compiled code before.

Note that I'm not recommending this as a course of action, I'm simply attempting to be thorough in covering the possibilities.

  $ ./config
  $ make
  $ make test
  $ make install

Sources:

https://www.openssl.org/source/

Installation instructions included in https://www.openssl.org/source/openssl-1.0.2j.tar.gz

As an alternative you could upgrade to xenial (16.04) which has version 1.0.2g already available or as Seth Arnold (Member Ubuntu Security Team) states here

"16.04 LTS's openssl package is based on a 1.0.2g starting point. If running 16.04 LTS is not an option then perhaps the backportpackage command from the ubuntu-dev-tools package could help you."

Improve this answer
7
  • 1
    upgrading openssl has lot of issues. First ruby points to old version of openssl which is provided by ubuntu its self and same case goes with nginx. So, if possible give me proper solution for upgrade. Solution you have given everyone knows. But why ubuntu is not releasing latest version of openssl as it is used as core software.
    – NEHAL AMIN
    Dec 23, 2016 at 5:41
  • @fkraiem Updated answer.
    – Elder Geek
    Dec 24, 2016 at 16:42
  • 1
    The fact that fixes will be backported, but only fixes, is confirmed by my contacts on the Security team. That said, they are not updating Trusty to a later OpenSSL version due to the extreme level of explosions that will happen with packages that are not updated for those 'newer' OpenSSL versions in that release
    – Thomas Ward ♦
    Dec 25, 2016 at 16:58
  • So, LTS really means "if it's not too much work"? I've been expecting to ride 14.04 until 18.04 comes out (in hopes that KDE will improve again), but now it looks like that's a bad idea...
    – Zeiss Ikon
    Feb 28, 2017 at 19:57
  • @ZeissIkon I'm not sure I understand your position here. Security patches are still being offered for 1.01 currently at 1.01f Why so upset?
    – Elder Geek
    Feb 28, 2017 at 20:04
0

This Ubuntu search page gives no indication that Canonical is offering a newer version of openssl for 14.04 LTS. Given the impending loss of all support for openssl 1.0.1, one would hope someone with package authority will backport 1.0.2 from 16.04, but that apparently has not yet occurred (as of December 22, 2016).

Improve this answer
1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .