nginx ubuntu package possibly affected by CVE 2014-0160

[Kai Jauslin]

Checked nginx ssl offloading with package 1.1.19-1ubuntu0.6 and openssl package 1.0.1-4ubuntu5.12 on Ubuntu 12.04 LTS.

Testing heartbleed according to https://blog.ipredator.se/2014/04/how-to-test-if-your-openssl-heartbleeds.html (with patched openssl client) shows vulnerability on system with updated openssl package.

Is openssl statically linked to nginx@1.1.19-1ubuntu0.6? If yes, the package might need to be updated.

[Seth Arnold (seth-arnold)]

Did you restart nginx or reboot your system after applying the update?

Thanks

[Kai Jauslin (kjauslin)]

Yes, I did restart the system. I think I've found the solution in the meantime: it's not sufficient to just update the openssl package, it's also necessary to update libssl1.0.0. After doing this and restarting nginx, the system does not respond to heartbeat requests anymore. Sorry, this was not clear for me just by reading the security note.

[Thomas Ward (teward)]

Correct me if I'm wrong, but doesn't this bug affect OpenSSL? The Security team released a fix for this in OpenSSL.

I will check to see if it's statically linked, but the last I checked it was not. I haven't recently checked this though.

[Seth Arnold (seth-arnold)]

Kai, thanks, that makes more sense. Have fun!

[Thomas Ward (teward)]

Refer to USN-2165-1 for the OpenSSL notice on this vulnerability, and about it being fixed. This applies to libssl as well.

I am almost certain nginx doesn't static-link to libssl. Again, I'll double check this.