11–20 of 547 posts
A couple more data points: I'm running Fedora 19 and Arch on my main dev machines/VMs and as of this posting are considered up-to-date. Both are vulnerable: [Fedora19] $ openssl version OpenSSL 1.0.1e-fips 11 Feb 2013 [Arch] $ openssl version OpenSSL 1.0.1f 6 Jan 2014
A couple more data points: I'm running Fedora 19 and Arch on my main dev machines/VMs and as of this posting are considered up-to-date. Both are vulnerable: [Fedora19] $ openssl version OpenSSL 1.0.1e-fips 11 Feb 2013 [Arch] $ openssl version OpenSSL 1.0.1f 6 Jan 2014
It would be unfortunate if a new package were to be released immediately only to be soon masked/recalled due to unforeseen consequences.
Of note, the Gentoo package was bumped approximately 2 hours after the advisory was published.
root# USE='-tls-heartbeat' emerge openssl
What's the quickest check to see if sshd, or any other listening process, is vulnerable?
(For example, if "lsof | grep ssl" only shows 0.9.8-ish version numbers, is that a good sign?)
"Yes, we can sell you our software!"
gentoo has a flag for the TLS heartbeat, so its easy to turn off. root# USE='-tls-heartbeat' emerge openssl
Got a long night ahead :/