I am reading the OpenSSL cookbook, and here what I see there

openssl version
OpenSSL 1.0.1 14 Mar 2012

And this my the version of mu Ubuntu 14.04 server

openssl version
OpenSSL 0.9.8w 23 Apr 2012

Isn't March earlier then April?

Here is what I have found on heart bleed website:

What versions of the OpenSSL are affected?

Status of different versions:

OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable
OpenSSL 1.0.1g is NOT vulnerable
OpenSSL 1.0.0 branch is NOT vulnerable
OpenSSL 0.9.8 branch is NOT vulnerable

Bug was introduced to OpenSSL in December 2011 and has been out in the wild since OpenSSL release 1.0.1 on 14th of March 2012. OpenSSL 1.0.1g released on 7th of April 2014 fixes the bug.

  • 4
    You should ignore the dates and base your reasoning off branch-numbers. Even though your 0.9 branch has had changes it doesn't mean that they include the backport of the change that fixes heartbleed. – RJFalconer Jan 25 '16 at 12:55
  • 1
    You can try this online test: ssllabs.com/ssltest – A.L Jan 25 '16 at 16:39
  • Is this OpenSSL from a Ubuntu repository? I don't use it myself, but launchpad.net/ubuntu/trusty/+source/openssl says 14.04 'Trusty' should have 1.0.1f-1ubuntu2.16 which is upstream 1.0.1f plus security patches (including the Heartbleed fix) following the Ubuntu (and Debian) policy of freezing upstream version and applying only critical patches. If using a Ubuntu package openssl version shows the version and date frozen at release; the patch version is only shown by the package name in dpkg or apt-cache. In any case 0.9.8-anything is safe from Heartbleed. – dave_thompson_085 Jan 26 '16 at 11:27

From https://www.openssl.org/news/vulnerabilities.html

CVE-2014-0160 (OpenSSL advisory) 7th April 2014: A missing bounds check in the handling of the TLS heartbeat extension can be used to reveal up to 64kB of memory to a connected client or server (a.k.a. Heartbleed). This issue did not affect versions of OpenSSL prior to 1.0.1. Reported by Neel Mehta. Fixed in OpenSSL 1.0.1g (Affected 1.0.1f, 1.0.1e, 1.0.1d, 1.0.1c, 1.0.1b, 1.0.1a, 1.0.1)

I believe this is quite self-explanatory.


It appears your version of 0.9.8 was patched after the first release of 1.0.1 but actually dates back to July 5, 2005. The main versions would be developed further but your version was presumably patched for security vulnerabilities that were found.

For clarity:

0.9.8 July 205
1.0.1 14 Mar 2012
0.9.8w 23 Apr 2012

Your version is quite old and may be open to Heartbleed, review and upgrade as required (.8zh is latest)

  • updated the question – Edik Mkoyan Jan 25 '16 at 12:52
  • Note that this assumes that .8zh contains the fix, which is not implied by the statement "OpenSSL 1.0.1g released on 7th of April 2014 fixes the bug", regardless of dates. (In actuality, it's almost certainly been backported, but let's be precise here). – RJFalconer Jan 25 '16 at 12:59
  • 1
    @RJFalconer Question was radically changed from when I initially responded. – Linef4ult Jan 25 '16 at 13:08
  • 4
    0.9.8 July 205?!? That's some old software! – wizzwizz4 Jan 25 '16 at 16:55
  • @RJFalconer &Linef: 0.9.8 and 1.0.0 never contained the heartbeat code that had the bug, and so never had and still do not have the vulnerability. 0.9.8 is indeed up to zh -- and as of this month officially unsupported upstream. But AFAICS it was not (and is not) supported by Ubuntu 14.04 anyway. – dave_thompson_085 Jan 26 '16 at 11:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.