2014-04-08 8:00 GMT-03:00 Rex Dieter <rdieter(a)math.unl.edu>:
Patrick O'Callaghan wrote:
> On Tue, 2014-04-08 at 10:55 +0100, Patrick O'Callaghan wrote:
>>
https://www.openssl.org/news/secadv_20140407.txt
>>
>> See also
http://heartbleed.com/ and
>>
http://arstechnica.com/security/2014/04/critical-crypto-bug-in-openssl-op...
>>
>> This is potentially very serious and can cause leakage of private keys
>> and other information.
>>
>> The current version of OpenSSL on Fedora (standard repos and Koji) is
>> 1.0.1e, which has this vulnerability. An upgrade to 1.0.1g should be
>> provided urgently.
>
> Correction: a patched version of 1.0.1e is available on Koji
>
http://koji.fedoraproject.org/koji/buildinfo?buildID=509741 Presumably
> it will make its way to the repos.
On it's way, see:
https://admin.fedoraproject.org/updates/openssl-1.0.1e-37.fc20.1
https://admin.fedoraproject.org/updates/openssl-1.0.1e-37.fc19.1
Why did we get so behind this? I was expecting the upgrade to be
available by now (I was able to upgrade some Debian servers already 8
hours ago).
I'm a bit disappointed, and think these issues should be addressed ASAP.
--
Martín Marqués
http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Training & Services