2

I am testing my raspberry pi3 against security tests. I am using the newest Raspbian Stretch Lite. Version: November 2017 Release date: 2017-11-29 Kernel version: 4.9

I looked at http://heartbleed.com/

They mention these versions for OpenSSL being vulnerable:

OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable
OpenSSL 1.0.1g is NOT vulnerable
OpenSSL 1.0.0 branch is NOT vulnerable
OpenSSL 0.9.8 branch is NOT vulnerable

But when I check with this website:

https://www.site24x7.com/check-heartbleed-vulnerability.html

It says I am open to heartbleed for openssl when I put in my test server website naturalpainease.com

The issue is that I have OpenSSL 1.1.0f which I can't find anything for heartbleed in this version. I have seen it for version 1.0.1f.

Is version 1.1.0f for Raspbian Stretch Lite vulnerable to heartbleed? Are there any more updates I need to do on this version, or is this site24x7 not giving me correct info?

  • 1
    OpenSSL 1.1.0 does not contain the Heartbleed bug. Here's the site I recall using back when Heartbleed made the headlines: filippo.io/Heartbleed It reports that your https connection is refused, which is what I see on your port 443 as well, so I'm not sure how site24x7 is coming up with its result. Can you start up your https service in Apache and test again with these and other tester sites? – jdonald Dec 30 '17 at 21:37
  • Thank you so much! I thought I may have been missing something in my research... – Sol Dec 31 '17 at 0:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.