0

https://www.openssl.org/news/secadv/20140605.txt

I need the fixes for the issues in this security advisory, for running cryptocurrency wallets.

(See https://www.cryptocoinsnews.com/bitcoin-core-0-9-2-released-fixes-yet-another-openssl-vulnerability/ for more info)

But here's what I get when I check the OpenSSL version I have installed:

$ openssl version
OpenSSL 1.0.1f 6 Jan 2014

Apparently fixes are backported? But the date that library shows gives me significant worries. How can I be sure that these fixes were backported to the version of OpenSSL I have installed?

1 Answer 1

1

The easiest way to find if issues are fixed are to search for the individual CVE numbers (which are in the notice there that went out) in the Security Team CVE Tracker. This indicates whether specific CVEs have been fixed in Ubuntu or not, or whether the CVE even affects Ubuntu.

With regards to the notice you linked, all the CVEs referenced in it are already fixed in Ubuntu's OpenSSL pacakges.

Obligatory link dump of Ubuntu Security Team CVE tracker data for some of the CVEs in the OpenSSL notice:


A note about OpenSSL Package Revision Numbers and the openssl version output

The packages for OpenSSL in Ubuntu are, for the most part, version locked to a specific version of OpenSSL in each Ubuntu release. That is to say, for Trusty, the core OpenSSL version is OpenSSL 1.0.1f, from January 2014. This is only the core library versions, it does not take into account patches applied to it, etc.

The way to determine whether the package has been updated with patches, etc. is via the Debian package revision number and corresponding changelog entries. The version of the OpenSSL package and corresponding libraries in Ubuntu Trusty is currently as of this post:

 openssl | 1.0.1f-1ubuntu2    | trusty           | source, amd64, arm64, armhf, i386, powerpc, ppc64el
 openssl | 1.0.1f-1ubuntu2.21 | trusty-security  | source, amd64, arm64, armhf, i386, powerpc, ppc64el
 openssl | 1.0.1f-1ubuntu2.21 | trusty-updates   | source, amd64, arm64, armhf, i386, powerpc, ppc64el

Looking at the second column, we see that the latest version available for OpenSSL is 1.0.1f-1ubuntu2.21, which means it has had multiple revisions since the initial Trusty release (which had 1.0.1f-1ubuntu2).

The package build rules for OpenSSL's package do not use the Debian string in the version data. It uses only the OpenSSL original version string, 1.0.1f. This is why openssl version is misleading, and for pre-packaged versions of OpenSSL, you rely on the changelogs for the package, the Ubuntu security tracker, and the version string on the package rather than the version command in the packaged software (for OpenSSL, at least).

5
  • Hmm... but my Open SSL package is apparently from 6th Jan 2014, so how could they fix issues from later (June etc.) in 2014?
    – Green Mo
    Commented Oct 3, 2016 at 19:25
  • And they are fixed in packages with names like 1.0.1f-1ubuntu2 according to those links, but I just have 1.0.1f according to 'openssl version'.
    – Green Mo
    Commented Oct 3, 2016 at 19:26
  • $ apt-cache policy openssl openssl: Installed: 1.0.1f-1ubuntu2.21 Candidate: 1.0.1f-1ubuntu2.21 Version table: *** 1.0.1f-1ubuntu2.21 0 500 http://archive.ubuntu.com/ubuntu/ trusty-updates/main amd64 Packages 500 http://archive.ubuntu.com/ubuntu/ trusty-security/main amd64 Packages 100 /var/lib/dpkg/status 1.0.1f-1ubuntu2 0 500 http://archive.ubuntu.com/ubuntu/ trusty/main amd64 Packages I guess it's OK?
    – Green Mo
    Commented Oct 3, 2016 at 19:42
  • @GreenMo The build string is version locked/fixed. That's the original build of OpenSSL included, the version string changes by the -ubuntuX.Y prefix to indicate package changes that didn't include a full code version bump. Do not rely solely on openssl version when using the prepackaged OpenSSL, rely on that version string plus the installed Ubuntu package revision number.
    – Thomas Ward
    Commented Oct 3, 2016 at 19:51
  • @GreenMo I've detailed the version string stuff more in the answer.
    – Thomas Ward
    Commented Oct 3, 2016 at 20:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .