4 ms·

As of now (21:04 UTC) this isn't fixed in Debian https://security-tracker.debian.org/tracker/CVE-2014-0160 https://security-tracker.debian.org/tracker/CVE-2014-

As of now (21:04 UTC) this isn't fixed in Debian https://security-tracker.debian.org/tracker/CVE-2014-0160 https://security-tracker.debian.org/tracker/CVE-2014-0160 nor Ubuntu http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-0160.html http://people.canonical.com/~ubuntu-security/cve/2014/CVE-20... Got a long night ahead :/

stu_k 13y ago
Thanks for the links. The big thing heartbleed.com is missing is what to do!
MattHeard 13y ago
Should the priority on the ubuntu-security page be higher than "Medium"?
- F30 13y ago
  Basically yes. However, from my experience, package update urgencies are no good indicator of the updates's actual priority. It's in the +*-security" channels and you're supposed to apply all updates from there.
deleted 13y ago
[deleted]
jabo 13y ago
I just did a apt-get update and apt-get upgrade and I saw upgrades for openssh-client and openssh-server.
- makomk 13y ago
  OpenSSH != OpenSSL. Those upgrades are for a different vulnerability in OpenSSH.
  - jabo 13y ago
    Oh yeah, you're right.
- pdonis 13y ago
  Just got an openssl upgrade pushed by Ubuntu 12.04 as well.
mappu 13y ago
1.0.1e-2+deb7u5 appearing now on security.debian.org.
mfwoods 13y ago
I just installed update openssl_1.0.1e-2+deb7u5 and libssl1.0.0_1.0.1e-2+deb7u5 on debian wheezy, so it seems the fix is now available.
- josh-wrale 13y ago
  Just saw the following updated when I did an 'apt-get clean; aptitude dist-upgrade' on Debian Wheezy: libssl1.0.0 openssh-client openssh-server openssl ssh
  - dfc 13y ago
    I just wanted to point out that you really do not need the `apt-get clean.` Obviously your work flow is your business but I wanted to speak up in case you thought it was needed before upgrading packages.
    - josh-wrale 13y ago
      I meant to say 'apt-get update'. Thanks for the heads up. I like to be sure I have the latest package metadata.
- 0x0 13y ago
  You need to manually restart all processes linking libssl, too. Something like "lsof -n | grep ssl | grep DEL" can identify processes using the DELeted old version of libssl after apt-get upgrading.
  - mfwoods 13y ago
    Thanks for reminding, almost forgot about that.
  - eikenberry 13y ago
    Debian comes with a handy tool for this called 'checkrestart' in the debian-goodies package. sudo apt-get install debian-goodies sudo checkrestart
deleted 13y ago
[deleted]
neo2001 13y ago
Ubuntu 12.04 patch ready https://launchpad.net/ubuntu/+source/openssl/1.0.1-4ubuntu5.12 https://launchpad.net/ubuntu/+source/openssl/1.0.1-4ubuntu5....

stu_k 13y ago

Thanks for the links. The big thing heartbleed.com is missing is what to do!

MattHeard 13y ago

Should the priority on the ubuntu-security page be higher than "Medium"?

F30 13y ago
Basically yes. However, from my experience, package update urgencies are no good indicator of the updates's actual priority. It's in the +*-security" channels and you're supposed to apply all updates from there.

deleted 13y ago

[deleted]

jabo 13y ago

I just did a apt-get update and apt-get upgrade and I saw upgrades for openssh-client and openssh-server.

makomk 13y ago
OpenSSH != OpenSSL. Those upgrades are for a different vulnerability in OpenSSH.
- jabo 13y ago
  Oh yeah, you're right.
pdonis 13y ago
Just got an openssl upgrade pushed by Ubuntu 12.04 as well.

mappu 13y ago

1.0.1e-2+deb7u5 appearing now on security.debian.org.

mfwoods 13y ago

I just installed update openssl_1.0.1e-2+deb7u5 and libssl1.0.0_1.0.1e-2+deb7u5 on debian wheezy, so it seems the fix is now available.

josh-wrale 13y ago
Just saw the following updated when I did an 'apt-get clean; aptitude dist-upgrade' on Debian Wheezy: libssl1.0.0 openssh-client openssh-server openssl ssh
- dfc 13y ago
  I just wanted to point out that you really do not need the `apt-get clean.` Obviously your work flow is your business but I wanted to speak up in case you thought it was needed before upgrading packages.
  - josh-wrale 13y ago
    I meant to say 'apt-get update'. Thanks for the heads up. I like to be sure I have the latest package metadata.
0x0 13y ago
You need to manually restart all processes linking libssl, too. Something like "lsof -n | grep ssl | grep DEL" can identify processes using the DELeted old version of libssl after apt-get upgrading.
- mfwoods 13y ago
  Thanks for reminding, almost forgot about that.
- eikenberry 13y ago
  Debian comes with a handy tool for this called 'checkrestart' in the debian-goodies package. sudo apt-get install debian-goodies sudo checkrestart

deleted 13y ago

[deleted]

neo2001 13y ago

Ubuntu 12.04 patch ready https://launchpad.net/ubuntu/+source/openssl/1.0.1-4ubuntu5.12 https://launchpad.net/ubuntu/+source/openssl/1.0.1-4ubuntu5....