3 ms·

For the average developer what do I need to do? I don't use OpenSSL directly but I'm pretty sure some parts of my tech stack use it as a dependency. Do I simply

• vbezhenar 6y ago
  Restart your services or better reboot your server to be sure.
• tedunangst 6y ago
  Maintain a constant state of suspicious alertness until March 25th.
• qbasic_forever 6y ago
  Watch the debian security mailing list for information about when their fix is available to others through apt: https://lists.debian.org/debian-security-announce/ https://lists.debian.org/debian-security-announce/ In general you should be following this list if you're managing production services running debian or ubuntu.
• throw0101a 6y ago
  > Do I simply need to run `apt-get upgrade` on the 25th? Mostly, but some details matter. Make sure that when you do the upgrade, that you are fetching the fixed version. Check for the security announcement and see which version things get fixed in: * https://www.debian.org/security/ https://www.debian.org/security/ Once the CVE is known, you can also see which versions are vulnerable and which are fixed: * https://security-tracker.debian.org/tracker/CVE-2020-1971 https://security-tracker.debian.org/tracker/CVE-2020-1971 You may have to restart some services. The checkrestart utility is handy to find these: * https://packages.debian.org/buster/debian-goodies https://packages.debian.org/buster/debian-goodies * https://packages.debian.org/search?keywords=debian-goodies https://packages.debian.org/search?keywords=debian-goodies