Heartbleed

[blueisaak]

Hi,

tried to pach debian on A20 for Heartbleed. But it seems the standard repositories haven't been updated jet.
After:

Code Select Expand

sudo apt-get update
sudo apt-get install -y libssl1.0.0 openssl
openssl version still shows OpenSSL 1.0.1e

Has anyone any ides how to get a easy update

Thanks in advance
Isaak

[hnb2907]

Hi,

Not sure if it helps...
I pointed http://filippo.io/Heartbleed/ at my https server (running on a installation based on the olimex/debian image) last night, and it said it was ok.

Cheers,
Chris.

[blueisaak]

Well well,

shame on me; did the update but forgot to restart all services. Now after the good old "Have you tried to tun it off and on again?"(reboot) the test on http://filippo.io/Heartbleed results in a "All good".

Although all sites tell me if the Openssl version is 1.0.1e and from before 09.04.2014 it is bad...

But anyway thanks!
Cheers Isaaak

[hnb2907]

If I read it correctly somewhere, the version in the repo's we're point to, has been patched with a fix?

C.

[blueisaak]

Hi,

these are the repos listed in my /etc/apt/sources.list:

Code Select Expand


deb http://ftp.debian.org/debian/ wheezy main contrib non-free
deb-src http://ftp.debian.org/debian/ wheezy main contrib non-free

and it looks like they are not patched. This morning I ran the test again and it failed.

Still looking for a solution.

Cheers

[hnb2907]

hmmm, I've retested my site, and now it also fails.  I noticed that http://filippo.io/Heartbleed/ has changed, so maybe the test is more vigorous now.


C.

[PaceyIV]

Still looking for a solution.

You should change your source.list with the lines below to enable security updates!

Code Select Expand


deb http://ftp.debian.org/debian/ wheezy main contrib non-free
deb-src http://ftp.debian.org/debian/ wheezy main contrib non-free

deb http://http.debian.net/debian wheezy-updates main contrib non-free
deb-src http://http.debian.net/debian wheezy-updates main contrib non-free

deb http://security.debian.org/debian-security wheezy/updates main contrib non-free
deb-src http://security.debian.org/ wheezy/updates main contrib non-free


[hnb2907]

Thanks PaceyIV, all good now for me

I wouldn't have known which repo's to add!