I was alerted this morning to possible vulnerabilities in this article. According to the article, -current has the latest patches which are recommended, but for the sake of peace of mind, I went to the OpenSSL site, downloaded the latest sources, and built the package(s). As a public service for all Slackers utilizing this forum, I have uploaded the packages, and am offering it for download to anyone interested.

openssl-1.0.2a
openssl-solibs-1.0.2a

Please note that these are for x86-64 users only, as I only have 64-bit hardware.

Happy Slacking!

Regards,

Matt

Thanks but I wouldn't recommend to replace the patched openssl{,-solibs} official Slackware package, released on Fri, 9 Jan 2015 with a third-party one. Furthermore you don't say for which Slackware version it is build (is it for -current?), nor provide build material at time of writing.

I'd suggest instead to just follow the official Security Advisory or for a very sensitive installation rebuild the packages with one of the patched versions linked to by mancha in this post.

1 members found this post helpful.

Who would trust your copies of software. As good policy only signed (DSA) packages should be used/installed from official source.

Didier: I used PV's SlackBuild from a mirror site, and I am using -current. I should have made that clear. As for 'build material', it is unclear exactly what you mean, unless you are referring to the SlackBuild (I didn't compile it manually).

veerain: Trust has to start somewhere, and although I am not mancha and have not, as yet, have a proven reputation for reliability, I do have a vested interest in seeing my system run smoothly, as I am a fellow Slacker. The packages are available; do with it (or not) as you will. If you want to wait for an official source to come out with the patched version, that is your prerogative. I am merely making updated packages available for download because I thought fellow Slackers would be interested in knowing about the vulnerability, and upgrading. Perhaps I assumed too much in building the package myself, given the emphasis on security; using a trusted site is far preferred to a random site (such as how mine would be perceived at the present).

Happy Slacking!

2 members found this post helpful.