Let me reframe the last question..
What I meant to say is, could someone provide some info on how to test/verify whether the openSSL version has in fact been patched to confirm whether a backport update has in fact occurred? Thanks, Shawn From: [email protected] [mailto:[email protected]] On Behalf Of s...@wn Sent: Thursday, January 21, 2010 1:42 PM To: [email protected] Subject: Query about verifying updates on OpenSSL Hi, I probably have a silly question but, I currently have a bunch of customized Linux operating systems and on it runs OpenSSL. The version and rpm check indicates "OpenSSL 0.9.8h 28 May 2008" which is an older version. Furthermore, the change logs too indicate the latest update as: OpenSSL CHANGES _______________ Changes between 0.9.8g and 0.9.8h [28 May 2008] It is important to have the latest OpenSSL security patches in but, due to backport updates version compares are NOT useful. How can one definitely confirm that OpenSSL has in fact been patched to the latest version? I see no full disclosures on vulns in the versions between 0.9.8h to the latest that would help me confirm whether it has been patched or NOT. Could someone help me out with testing and confirming this? Thanks, Shawn
