openssl rpm availability?

KimVette · 01-15-2006, 01:53 AM

Is there a trusted source for OpenSSL 0.9.8a for SuSE 9.3 and SuSE 10.0 (binaries, that is)? The latest update posted for 9.3 is OpenSSL 0.9.7e and the latest for SuSE 10 is OpenSSL 0.9.7g - both of which are vulnerable.

acid_kewpie · 01-15-2006, 02:09 AM

well surely suse themselves have patched against those vulnerabilites specifically? That's what RedHat does. In a security centered environment i'd rather have an older version patched against known flaws than a newer one which may have introduced brand new flaws that haven't been found yet.

KimVette · 01-15-2006, 02:36 AM

As a test I set up a virtual host on it, on SuSE 9.3 and sure enough within a few hours it got hit - clamav turned up positives (.cinik in directories where ssl was enabled). Granted this was weeks ago and I just downloaded a slew of patches but I'd rather get up to 0.9.8a where the OpenSSL team knows for sure that vulnerability is fixed.