Hi,
I probably have a silly question but, I currently have a bunch of customized Linux operating systems and on it runs OpenSSL. The version and rpm check indicates "OpenSSL 0.9.8h 28 May 2008" which is an older version. Furthermore, the change logs too indicate the latest update as: OpenSSL CHANGES _______________ Changes between 0.9.8g and 0.9.8h [28 May 2008] It is important to have the latest OpenSSL security patches in but, due to backport updates version compares are NOT useful. How can one definitely confirm that OpenSSL has in fact been patched to the latest version? I see no full disclosures on vulns in the versions between 0.9.8h to the latest that would help me confirm whether it has been patched or NOT. Could someone help me out with testing and confirming this? Thanks, Shawn
