openssl vulnerable to remote memory reads (aka heartbleeed bug) - grave error

[Paul Traina]

The openssl heartbleed bug exposes server memory to remote attackers. Specifically, people have been able to pull down SSL private keys, plaintext passwords, and compromising pictures of you and that goat when you were partying in Mexico.
The exploit is in the wild.

Debian bug 743833 for CVE-2014-0160 was just built and pushed by the Debian security team yesterday, they classified it as a grave security bug, and that's accurate. It's one of the worst I've seen in years because it doesn't just create a crash, it exposes private keys and plaintext passwords.

This is a request for an IMMEDIATE pull and incorporation of the debian security fix into raspbian. Our current version, openssl 1.0.1e-2+deb7u4 is vulnerable, as this was fixed in debian 1.0.1e-2+deb7u5.

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=743883
http://www.openssl.org/news/secadv_20140407.txt
http://heartbleed.com/

[peter green (plugwash)]

This should be fixed in 1.0.1e-2+rvt+deb7u5 which i'm pushing out at the momement.

Sorry for the delay, we had some infrustructure issues which combined with this patch needing manual attention due to previous changes we made to openssl have slowed things down a bit.

[Paul Traina (a-maio-g)]

Peter, just to follow up, debian today released a deb7u6 version of this package.

There is no change to the openssl code itself, instead they augmented the package infrastructure to restart all running daemons that rely upon openssl (otherwise the old library might still be in memory). A good idea, but not the end of the world.

This is just a FYI, not necessarily a reason to reopen.