The Heartbleed bug has a lot of people asking how to check the version of an installed package. I'm included since I have not discovered a way.
Unfortunately, backpatching has made version checking nearly useless because the info remains at the downlevel. For example (from Fedora):
$ openssl version -a OpenSSL 1.0.1e-fips 11 Feb 2013 built on: Tue Apr 8 00:29:11 UTC 2014 platform: linux-x86_64 options: bn(64,64) md2(int) rc4(16x,int) des(idx,cisc,16,int) idea(int) ... compiler: gcc -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT ... OPENSSLDIR: "/etc/pki/tls" engines: dynamic
And Yum and Apt-Get are no better because they do not provide an effective security version (from Fedora with Yum):
$ yum info openssl Loaded plugins: langpacks, refresh-packagekit Installed Packages Name : openssl Arch : x86_64 Epoch : 1 Version : 1.0.1e Release : 37.fc19.1 Size : 1.5 M Repo : installed From repo : updates Summary : Utilities from the general purpose cryptography library with TLS : implementation URL : http://www.openssl.org/ License : OpenSSL Description : The OpenSSL toolkit provides support for secure communications : between machines. OpenSSL includes a certificate management tool : and shared libraries which provide various cryptographic : algorithms and protocols.
And (from Ubuntu and Apt-Cache):
$ apt-cache showpkg openssl Package: openssl Versions: 1.0.1e-3ubuntu1.2 (/var/lib/apt/lists/us.archive.ubuntu.com_ubuntu_dists_saucy-updates_main_binary-amd64_Packages) (/var/lib/apt/lists/security.ubuntu.com_ubuntu_dists_saucy-security_main_binary-amd64_Packages) (/var/lib/dpkg/status) Description Language: File: /var/lib/apt/lists/us.archive.ubuntu.com_ubuntu_dists_saucy_main_binary-amd64_Packages MD5: 977022bc5545601176b69704acc5df9b Description Language: en File: /var/lib/apt/lists/us.archive.ubuntu.com_ubuntu_dists_saucy_main_i18n_Translation-en MD5: 977022bc5545601176b69704acc5df9b 1.0.1e-3ubuntu1 (/var/lib/apt/lists/us.archive.ubuntu.com_ubuntu_dists_saucy_main_binary-amd64_Packages) ... Provides: 1.0.1e-3ubuntu1.2 - 1.0.1e-3ubuntu1 -
As can be seen above, there's no information available on the effective security version ("1.0.1g"). The only information provided is that OpenSSL is downlevel ("1.0.1e") and possibly vulnerable to the latest bug.
Backpatching and downlevel version numbers has got to be one of the dumbest security decisions in history. Its right up there with
(1) opportunistic encryption is bad, plain text is good (browsers), and
(2) using public information as a secret/challenge question.
How does one determine the effective security version of a package that has been backpatched when using Yum and Apt-Get? (This is a generalized question, and not particular to OpenSSL).