It seems like Raspbian has not been updated yet to deal with the Heartbleed bug. sudo apt-get update then sudo apt-get upgrade doesn't update anything (this is a system which was freshly updated yesterday so it is all up to date otherwise).

When I do sudo apt-get install openssl it tells me the latest version is installed, while openssl version tells me 1.0.1e is still installed. The first non-vulnerable version of OpenSSL is 1.0.1g, so how do I update to this?

  • 2
    I just checked my OpenSSl version from raspbian and it uses 0.9.8 which is not vulnerable according to heartbleed.com – user14106 Apr 9 '14 at 19:24

The core affected package is libssl1.0.0, which if you can, just replace with the patched version, restart everything. You can try to download a binary, and manually install an arm-hf, using dpkg with the version 1.0.1e-2+deb7u5 for wheezy.

You can also use the jessie repository, just for this single one time update, which should get you version 1.0.1g-1.

After install and reboot you it is strongly recommended to revoke all keys and certificates and regenerate everything from scratch, using new passwords and vectors.

As of 09/04/2014 the main wheezy repository uses the patched version 1.0.1e-2+deb7u5 and as commented, you can get it like this:

> sudo apt-get update 
> sudo apt-get upgrade

Which will update the following packages:

libssl1.0.0 openssh-client openssh-server openssl ssh

*Here is how to selectively upgrade certain packages using jessie repository, without completely breaking wheezy, and will install the latest g version

Add the following two lines into /etc/apt/sources.list

deb http://mirrordirector.raspbian.org/raspbian/ jessie main contrib non-free rpi
deb http://archive.raspbian.org/raspbian jessie main contrib non-free rpi

You then edit the file /etc/apt/preferences (create the file if doesn't exist) to tell apt in which repositories it should look to do an update. We put jessie on a low priorty so that when you use apt-get update it will ignore jessie and use wheezy repo instead. This is important for the step after this one.

Package: *
Pin: release n=wheezy
Pin-Priority: 900

Package: *
Pin: release n=jessie
Pin-Priority: 300

Package: *
Pin: release o=Raspbian
Pin-Priority: -10

Now, at your free will you can tell apt to use jessie instead.

apt-get update
apt-get -t jessie install openssl libssl1.0.0 openssh-client openssh-server ssh

*An extract from Chapter 6, Raspberry Pi Server Essentials.

  • 1
    Can you show how to use the jessie repository for just one update? – HeatfanJohn Apr 8 '14 at 19:46
  • 1
    Thanks for pointing that out. The hosting company disabled my site a few months ago and my ISP blocks access to the site so I hadn't checked it in some time. I used Google to view the cached content and indeed it looks suspect. Thanks again. Your book looks great, I previewed it on Amazon. – HeatfanJohn Apr 8 '14 at 20:21
  • 3
    This has been fixed right now, and I updated the raspberry pi with the normal repositories. – gabrign Apr 9 '14 at 8:56
  • 1
    Yep, this is in the current updates: > sudo apt-get update > sudo apt-get upgrade The following packages will be upgraded: libssl1.0.0 openssh-client openssh-server openssl ssh – keithl8041 Apr 9 '14 at 9:44
  • 2
    In my case, the latest version is 1.0.1e-2+rvt+deb7u6. I'm not sure what the rvt portion is, but the deb7u6 indicates to me that it's good. (Posting to help with searches.) – treat your mods well Apr 11 '14 at 0:47

protected by Piotr Kula Apr 10 '14 at 8:38

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.