OpenSSL is not up-to-date in Ubuntu 13.10

[jean-christophe manciot]

I have noticed that OpenSSL and libssl have been updated to release 1.0.1e. When you take a careful look at the latest release on the official site, it's 1.0.1g: http://www.openssl.org/news/

You might want to check this screenshot on my machine: https://docs.google.com/document/d/1UaYD0IhZdpeZydJ8MA1h5nOjTBbFLlW8VSI3LSoKTY4/edit?usp=sharing

The OpenSSL version is 1.0.1e when the latest official sources are 1.0.1g!

Build date and version are 2 very different things!

[Marc Deslauriers (mdeslaur)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. This is not a bug, but rather expected behavior:
https://wiki.ubuntu.com/SecurityTeam/FAQ#Versions

Please feel free to report any other bugs you may find.

[jean-christophe manciot (manciot-jeanchristophe)]

You cannot say that you've not been warned.
It's up to you to stick with the old OpenSSL release.
I'm going to build the last 1.0.1g on my system from the sources.

[Marc Deslauriers (mdeslaur)]

What exactly are you warning us about?

Security fixes are backported to the stable openssl versions that are in each release.

For example, heartbleed (CVE-2014-0160) was fixed in 1.0.1e-3ubuntu1.2 released April 7th with the following USN:

http://www.ubuntu.com/usn/usn-2165-1/

[jean-christophe manciot (manciot-jeanchristophe)]

Someone has updated openssl with sources dated 11th of feb, weeks before the Heartbleed issue was made public.
The last official sources were updated on the 7th of April (not the built date, the sources date).

[Marc Deslauriers (mdeslaur)]

Try:

openssl version -b

What's the result?

[jean-christophe manciot (manciot-jeanchristophe)]

Now that I've compiled the latest OpenSSL sources available here (1.0.1g): http://www.openssl.org/source/

I can check the OpenSSL version with "openssl version -a" (not -b; with this you only get the built date, not the version which really matters): https://docs.google.com/document/d/1...it?usp=sharing

[Marc Deslauriers (mdeslaur)]

-a is only the date at which the original version came out, that isn't the date that matters for Ubuntu since, like most distros, we backport security fixes.

-b will show you when the package was built, and that is what is important.

You probably shouldn't attempt to maintain your own openssl, it will be much easier to stay up-to-date with security fixes if you use the one packaged.