Testing for heatbleed

stefan1959 · 04-17-2014, 08:17 PM

https://filippo.io/Heartbleed/

The BLFS has a security warning about OpenSSL-1.0.1f but maybe add its Heatbleed Vulnerability in the warning as well see its very public at the moment.

Steve

ReaperX7 · 04-17-2014, 08:22 PM

BLFS-SVN has 1.0.1g so you can safely use it.

stoat · 04-17-2014, 09:23 PM

Also, existing BLFS 7.5 systems with openssl-1.0.1f can be upgraded to openssl-1.0.1g using the commands and patches for openssl-1.0.1g in the BLFS svn version. No BLFS packages are compiled against static openssl libraries (I don't even install them). And the libraries and header files of the g version are named the same as those in the f version.

ReaperX7 · 04-17-2014, 10:44 PM

Yep... that's one of the main principles of B/LFS's method "--disable-static". It allows you to dynamically upgrade against against other packages.