Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am reading the OpenSSL cookbook, and here what I see there

openssl version
OpenSSL 1.0.1 14 Mar 2012

And this my the version of mu Ubuntu 14.04 server

openssl version
OpenSSL 0.9.8w 23 Apr 2012

Isn't March earlier then April?

Here is what I have found on heart bleed website:

What versions of the OpenSSL are affected?

Status of different versions:

OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable
OpenSSL 1.0.1g is NOT vulnerable
OpenSSL 1.0.0 branch is NOT vulnerable
OpenSSL 0.9.8 branch is NOT vulnerable

Bug was introduced to OpenSSL in December 2011 and has been out in the wild since OpenSSL release 1.0.1 on 14th of March 2012. OpenSSL 1.0.1g released on 7th of April 2014 fixes the bug.

share|improve this question
4  
You should ignore the dates and base your reasoning off branch-numbers. Even though your 0.9 branch has had changes it doesn't mean that they include the backport of the change that fixes heartbleed. – RJFalconer Jan 25 at 12:55
1  
You can try this online test: ssllabs.com/ssltest – A.L Jan 25 at 16:39
    
Is this OpenSSL from a Ubuntu repository? I don't use it myself, but launchpad.net/ubuntu/trusty/+source/openssl says 14.04 'Trusty' should have 1.0.1f-1ubuntu2.16 which is upstream 1.0.1f plus security patches (including the Heartbleed fix) following the Ubuntu (and Debian) policy of freezing upstream version and applying only critical patches. If using a Ubuntu package openssl version shows the version and date frozen at release; the patch version is only shown by the package name in dpkg or apt-cache. In any case 0.9.8-anything is safe from Heartbleed. – dave_thompson_085 Jan 26 at 11:27
up vote 8 down vote accepted

From https://www.openssl.org/news/vulnerabilities.html

CVE-2014-0160 (OpenSSL advisory) 7th April 2014: A missing bounds check in the handling of the TLS heartbeat extension can be used to reveal up to 64kB of memory to a connected client or server (a.k.a. Heartbleed). This issue did not affect versions of OpenSSL prior to 1.0.1. Reported by Neel Mehta. Fixed in OpenSSL 1.0.1g (Affected 1.0.1f, 1.0.1e, 1.0.1d, 1.0.1c, 1.0.1b, 1.0.1a, 1.0.1)

I believe this is quite self-explanatory.

share|improve this answer

It appears your version of 0.9.8 was patched after the first release of 1.0.1 but actually dates back to July 5, 2005. The main versions would be developed further but your version was presumably patched for security vulnerabilities that were found.

For clarity:

0.9.8 July 205
1.0.1 14 Mar 2012
0.9.8w 23 Apr 2012

Your version is quite old and may be open to Heartbleed, review and upgrade as required (.8zh is latest)

share|improve this answer
    
updated the question – Edik Mkoyan Jan 25 at 12:52
    
Note that this assumes that .8zh contains the fix, which is not implied by the statement "OpenSSL 1.0.1g released on 7th of April 2014 fixes the bug", regardless of dates. (In actuality, it's almost certainly been backported, but let's be precise here). – RJFalconer Jan 25 at 12:59
1  
@RJFalconer Question was radically changed from when I initially responded. – Linef4ult Jan 25 at 13:08
4  
0.9.8 July 205?!? That's some old software! – wizzwizz4 Jan 25 at 16:55
    
@RJFalconer &Linef: 0.9.8 and 1.0.0 never contained the heartbeat code that had the bug, and so never had and still do not have the vulnerability. 0.9.8 is indeed up to zh -- and as of this month officially unsupported upstream. But AFAICS it was not (and is not) supported by Ubuntu 14.04 anyway. – dave_thompson_085 Jan 26 at 11:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .