2

The latest updates for OpenSSL in Ubuntu have come out this month.

http://changelogs.ubuntu.com/changelogs/pool/main/o/openssl/openssl_1.0.2g-1ubuntu4.11/changelog

There's an extensive list of security updates there for v1.0.2g

Though I have installed OpenSSL v1.0.2n manually 2 months ago.

What I am asking is does this matter, specifically are Ubuntu updates on OpenSSL version customized and specific to Ubuntu? Shouldn't the latest version direct from the OpenSSL site cover all these? Should I revert back to an older version?

4

If you have manually installed your own version of OpenSSL instead of the version provided by Ubuntu, then you are responsible for keeping it updated, including installing any security patches.

It is usually safer to use the version provided by Ubuntu as you will then receive security updates through the normal update process.

The two will have different update schedules and processes, but both will aim to patch in a timely manner after a security issue is found. Ubuntu will backport the patch (ie rewrite the patch so it works on an older version) to the stable version in Ubuntu, whereas upstream may make the patch only available by updating to the latest version.

Another thing to be aware of is that many Ubuntu packages depend on an OpenSSL library. You may find that you have both the manually installed version and the Ubuntu-provided version installed due to it being brought in as a dependency.

| improve this answer | |
  • ah backport vs upstream, thanks for clairfying ...still learning – Sam Wheel Mar 29 '18 at 1:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.