CVE-2014-0160, aka "Heartbleed

[b4time]

Just for info sake on my f19 install following directions from the post in news the commands seem to give me an error. Just a heads up.

koji download-build --arch=x86_64 openssl-1.0.1e-37.fc19.1
openssl-perl-1.0.1e-37.fc19.1.x86_64.rpm                 | 105 kB     00:00 !!! 
openssl-1.0.1e-37.fc19.1.x86_64.rpm                      | 1.4 MB     00:02 !!! 
openssl-libs-1.0.1e-37.fc19.1.x86_64.rpm                 | 1.8 MB     00:03 !!! 
openssl-devel-1.0.1e-37.fc19.1.x86_64.rpm                | 2.4 MB     00:03 !!! 
openssl-static-1.0.1e-37.fc19.1.x86_64.rpm               | 1.9 MB     00:03 !!! 
[root@ ~]# yum localinstall openssl-1.0.1e-37.fc19.1.x86_64.rpm
Loaded plugins: fastestmirror, langpacks
Examining openssl-1.0.1e-37.fc19.1.x86_64.rpm: 1:openssl-1.0.1e-37.fc19.1.x86_64
Marking openssl-1.0.1e-37.fc19.1.x86_64.rpm as an update to 1:openssl-1.0.1e-37.fc19.x86_64
Resolving Dependencies
--> Running transaction check
---> Package openssl.x86_64 1:1.0.1e-37.fc19 will be updated
---> Package openssl.x86_64 1:1.0.1e-37.fc19.1 will be an update
--> Processing Dependency: openssl-libs(x86-64) = 1:1.0.1e-37.fc19.1 for package: 1:openssl-1.0.1e-37.fc19.1.x86_64
Loading mirror speeds from cached hostfile
 * fedora: fedora.bhs.mirrors.ovh.net
 * rpmfusion-free: mirror.us.leaseweb.net
 * rpmfusion-free-updates: mirror.us.leaseweb.net
 * rpmfusion-nonfree: mirror.us.leaseweb.net
 * rpmfusion-nonfree-updates: mirror.us.leaseweb.net
 * updates: fedora.bhs.mirrors.ovh.net
--> Finished Dependency Resolution
Error: Package: 1:openssl-1.0.1e-37.fc19.1.x86_64 (/openssl-1.0.1e-37.fc19.1.x86_64)
           Requires: openssl-libs(x86-64) = 1:1.0.1e-37.fc19.1
           Installed: 1:openssl-libs-1.0.1e-37.fc19.x86_64 (@updates)
               openssl-libs(x86-64) = 1:1.0.1e-37.fc19
           Available: 1:openssl-libs-1.0.1e-4.fc19.x86_64 (fedora)
               openssl-libs(x86-64) = 1:1.0.1e-4.fc19
 You could try using --skip-broken to work around the problem
 You could try running: rpm -Va --nofiles --nodigest

Since this forum is not an https web site, I'm thinking the answer is "No" but just want to make sure.

Thanks
Jim

[hadrons123]

You need to specify the openssl-libs package too while doing local install.
For me it was like this

yum install /home/steyn/Downloads/openssl-1.0.1e-37.fc20.1.x86_64.rpm /home/steyn/Downloads/openssl-libs-1.0.1e-37.fc20.1.x86_64.rpm

[b4time]

Funny that did not work either it stopped the install of the openssl-libs because a lot of other packages need the older openssl-libs package. I guess I'll wait for the update.

[hadrons123]

What are the packages which are affected?
My upgrade went fine.

[nightwishfan]

I updated from the build in koji. It worked with yum but not dnf.

[b4time]

Sorry for the delay the words in terminal were jumping off the page. Needed to get some sleep to make sure I'm functioning on all 8. If I remember right the packages that needed the old libs were cups and qt-4. I'll try again today to make sure.

[topiwala]

Is there anything else to be done other than this update?any form of Configuration to be applied?

[tempest766]

Any idea when a patch for F19 will be released?

See heartbleed.com or CVE-2014-0160 for details of this exploit.

[tempest766]

according to heartbleed.com 1.0.1e still contains the bug. The first that is fixed is 1.0.1g.

Fedora has not released a 1.0.1g or later fix for this problem.

[leigh123linux]

according to heartbleed.com 1.0.1e still contains the bug. The first that is fixed is 1.0.1g.

Fedora has not released a 1.0.1g or later fix for this problem.

version is irrelevant

http://pkgs.fedoraproject.org/cgit/o...e131c42ee78b70

[Dan]

Threads merged.

[leigh123linux]

Any idea when a patch for F19 will be released?

See heartbleed.com or CVE-2014-0160 for details of this exploit.

It's pending a push to stable

[wsanders]

FWIW CentOS's patch for this in the yum repo is "1.0.1e-16.el6_5.7", as is typical for Redhat the patch is backported to the existing version in the release.

[b4time]

I solved this it turns out on closer inspection the two packages were i686. Removed the two packages and bingo it updated. No clue when I installed those or why

[shouser]

In case this helps anyone else, I had a similar issue, with the same errors. For me, I had to use something like hadrons123's suggestion but for 3 of the rpms. So, after downloading the files as shown above:

yum install ./openssl-1.0.1e-37.fc19.1.x86_64.rpm ./openssl-libs-1.0.1e-37.fc19.1.x86_64.rpm ./openssl-devel-1.0.1e-37.fc19.1.x86_64.rpm