Hi On Tue, Apr 8, 2014 at 8:32 AM, Anatol Pomozov wrote:

Hi

On Tue, Apr 8, 2014 at 8:29 AM, Neal Oakey wrote:

...

Hi,

there is an Bug(1) in OpenSSL 1.0.1 and as far as I'm informed this has only been patched in 1.0.1g. Many other Distributions have build there own patch, what is with us?

It is fixed already. The new version of openssl is in stable repository already. https://www.archlinux.org/packages/core/x86_64/openssl/

...

Currently we have "1.0.1.f-2" which is effected as far as I can know.

One more tip: after you updated a system and installed new openssl package you need to restart services that still use old version of openssl. Here is one-liner (from [1]) that finds such applications for you: sudo lsof +c 0 | grep -w DEL | awk '1 { print $1 ": " $NF }' | grep ssl [1] https://wiki.archlinux.org/index.php/Pacman_Tips#Find_applications_that_use_...

Hi, ah ... ok kickt the top mirror - now I'm back up to date tanks Neal Am 08.04.2014 17:32, schrieb yaro@marupa.net:

On Tuesday, April 08, 2014 05:29:11 PM Neal Oakey wrote:

...

Hi,

there is an Bug(1) in OpenSSL 1.0.1 and as far as I'm informed this has only been patched in 1.0.1g. Many other Distributions have build there own patch, what is with us? Currently we have "1.0.1.f-2" which is effected as far as I can know.

Greetings Neal

1) (sry, German) http://www.golem.de/news/sicherheitsluecke-keys-auslesen-mit-openssl-1404-10 5685.html I see 1.0.1g, myself. Make sure your mirror is up to date.

Conrad

Slightly OT but for those interested, I added the heartbleed utility (used by the heartbleed checker site) to the AUR: https://aur.archlinux.org/packages/heartbleed-git/ % heartbleed mediacru.sh:443 2014/04/08 17:53:57 mediacru.sh:443 - SAFE J. Leclanche On Tue, Apr 8, 2014 at 5:35 PM, Anatol Pomozov wrote:

Hi

On Tue, Apr 8, 2014 at 9:29 AM, Pierre Schmitz wrote:

...

Am 08.04.2014 17:29, schrieb Neal Oakey:

...

Hi,

there is an Bug(1) in OpenSSL 1.0.1 and as far as I'm informed this has only been patched in 1.0.1g. Many other Distributions have build there own patch, what is with us? Currently we have "1.0.1.f-2" which is effected as far as I can know.

Greetings Neal

1) (sry, German) http://www.golem.de/news/sicherheitsluecke-keys-auslesen-mit-openssl-1404-10...

I actually did push an updated package within 3 hours after the public announcement. I think that is pretty reasonable especially since we are not among the fortunate distros and companies that were notified beforehand.

Is there any "secret security list" for distros where such issues are discussed/notified before a vulnerable gets public attention? If there is one then Arch should be added there as well.

I actually did push an updated package within 3 hours after the public announcement. I think that is pretty reasonable especially since we are not among the fortunate distros and companies that were notified beforehand.

It's very good! Only a few distribution and vendors can do that! What is the situation with the Archlinux websites and others servers? I remind that this flaw is rather critical and applying the patch/new version is probably not enough (especially if you are . There is already a lot of people playing with this bug and trying to extract "secrets" and sensitive data from servers. TLS private keys should be revoked and new ones get generated, as htpasswd etc. o/ RbN