Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

After reading the below mentioned article I understand that it is a good practice to check which version of OpenSSL Tomcat is using.

https://wiki.apache.org/tomcat/Security/Heartbleed

In the article there is this sentence:

What version of OpenSSL is Tomcat using?

This information is logged by AprLifecycleListener when Tomcat starts. For example,

10-Apr-2014 19:25:28.801 INFO [main] org.apache.catalina.core.AprLifecycleListener.init Loaded APR based Apache Tomcat Native library 1.1.30 using APR version 1.4.8.
10-Apr-2014 19:25:28.804 INFO [main] org.apache.catalina.core.AprLifecycleListener.init APR capabilities: IPv6 [true], sendfile [true], accept filters [false], random [true].
10-Apr-2014 19:25:29.955 INFO [main] org.apache.catalina.core.AprLifecycleListener.initializeSSL OpenSSL successfully initialized (OpenSSL 1.0.1g 7 Apr 2014)

I spent a couple of hours but I cannot find this information in the tomcat logs. Is there any other place where I have to look? Is there any other way to know it?

I'm on Windows Server 2003, Tomcat 6. I tried to lower down the log level to "Info" and then to "Debug" restarting the web server without obtaining this information.

share|improve this question

1 Answer 1

The version of Tomcat is not relevant here, it's the version of tcnative-1.dll you are using The latest is Tomcat Native 1.1.30. This is the heartbleed bug fix released 15 April 2014.

From Windows: check tcnative-1.dll properties to identify version.

If you had 1.1.23 or earlier, then you are safe from this particular vulnerability. If you were on 1.1.24-1.1.29, then you may be vulnerable.

If you use the default JSSE for your SSL support, then you are probably not affected anyway, no matter what version of OpenSSL your Tomcat has. Manually changing the SSL connector to use APR could make you vulnerable.

Edit

To view environment on startup

Edit $CATALINA_BASE\bin\setenv.bat (creating the file if necessary) and add the path to the tc-native libraries, apr and OpenSSL to PATH. For example:

set PATH=%PATH;C:\cygwin\home\support\tomcat-native-current-win32-src\jni\native\Debug;C:\cygwin\home\support\tomcat-native-current-win32-src\jni\apr\Debug;C:\OpenSSL\lib\VC

What versions of the OpenSSL are affected? Status of different versions of OpenSSL:

OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable OpenSSL 1.0.1g is NOT vulnerable OpenSSL 1.0.0 branch is NOT vulnerable OpenSSL 0.9.8 branch is NOT vulnerable Bug was introduced to OpenSSL in December 2011 and has been out in the wild since OpenSSL release 1.0.1 on 14th of March 2012. OpenSSL 1.0.1g released on 7th of April 2014 fixes the bug.

Ref:

share|improve this answer
    
So, summarizing I must only change the tcnative-1.dll with the new version and restart the service? –  Ziba Leah Apr 29 at 12:26
1  
yes, but as the wiki also says in steps 2 and 3,the keys may have been compromised to re-key your server and create new CSR to get new certificate and revoke compromised cerificates also to be sure –  Antony Apr 29 at 12:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.