4 ms·

Agree. This needs a big fat the world is coming to an end stlye of warning. I've just shut down the webservers running SSL that I can control. If you are vuln

by lawl 13y ago

Agree. This needs a big fat the world is coming to an end stlye of warning. I've just shut down the webservers running SSL that I can control. If you are vuln and don't want to build openssl from source and can afford the outage. I'd reccomend to do the same. OTHERWISE BUILD FROM SOURCE IMMEDIATELY, PATCH, AND GET NEW KEYS! Let's hope CA's don't get swamped by all the CSR's. Or rather let's hope they do so we see people are doing something... For me right now these are just my hobby projects. So I don't care if they're down. But I imagine it will be fun tomorrow. And when it's fixed, get new keys. Btw: I'm a dev. Not a sysadmin though :P Edit: Debian is patched. I'm online again \o/

M4v3R 13y ago
Ok, anyone could assist me on how to update openssl without breaking anything? I've fetched newest sources from openssl.org and compiled them, but "make install" doesn't actually install it, it only got compiled, but issuing "openssl version" still gives me the old version. What I want to do is to patch it so our webserver uses new version.
- josh-wrale 13y ago
  I would tread lightly here if you aren't comfortable with compiling. Rather than break your website, it might be better to take it down until your distro's packages are available. You should probably spend your time investigating a good method of reissuing keys for when you get to a stable OpenSSL version. Some apps have OpenSSL statically compiled into the binaries. Beware that what you think is fixed may not be.
  - M4v3R 13y ago
    Well, I'm not really in position of taking the whole service down at this moment, I would really like to have a way to patch it instead.
    - josh-wrale 13y ago
      Depending on the distro on which you're based, you may find that making a new package from a source package (e.g. srpm) would be the safest route even if you're in a hurry. If you're on Ubuntu, it would appear at least the updated base (OpenSSL itself) packages are now in the repos. http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-0160.html http://people.canonical.com/~ubuntu-security/cve/2014/CVE-20...
      - deleted 13y ago
        [deleted]
earless1 13y ago
Not to sound like a commercial for Cloudflare or anything. But putting your infrastructure behind their services can protect users while they perform their patching. According to their latest blog post http://blog.cloudflare.com/staying-ahead-of-openssl-vulnerabilities http://blog.cloudflare.com/staying-ahead-of-openssl-vulnerab...

by lawl 13y ago

M4v3R 13y ago

Ok, anyone could assist me on how to update openssl without breaking anything? I've fetched newest sources from openssl.org and compiled them, but "make install" doesn't actually install it, it only got compiled, but issuing "openssl version" still gives me the old version. What I want to do is to patch it so our webserver uses new version.

josh-wrale 13y ago
I would tread lightly here if you aren't comfortable with compiling. Rather than break your website, it might be better to take it down until your distro's packages are available. You should probably spend your time investigating a good method of reissuing keys for when you get to a stable OpenSSL version. Some apps have OpenSSL statically compiled into the binaries. Beware that what you think is fixed may not be.
- M4v3R 13y ago
  Well, I'm not really in position of taking the whole service down at this moment, I would really like to have a way to patch it instead.
  - josh-wrale 13y ago
    Depending on the distro on which you're based, you may find that making a new package from a source package (e.g. srpm) would be the safest route even if you're in a hurry. If you're on Ubuntu, it would appear at least the updated base (OpenSSL itself) packages are now in the repos. http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-0160.html http://people.canonical.com/~ubuntu-security/cve/2014/CVE-20...
    - deleted 13y ago
      [deleted]

earless1 13y ago

Not to sound like a commercial for Cloudflare or anything. But putting your infrastructure behind their services can protect users while they perform their patching. According to their latest blog post http://blog.cloudflare.com/staying-ahead-of-openssl-vulnerabilities http://blog.cloudflare.com/staying-ahead-of-openssl-vulnerab...