Hi On Tue, Apr 8, 2014 at 8:29 AM, Neal Oakey wrote:

Hi,

there is an Bug(1) in OpenSSL 1.0.1 and as far as I'm informed this has only been patched in 1.0.1g. Many other Distributions have build there own patch, what is with us?

It is fixed already. The new version of openssl is in stable repository already. https://www.archlinux.org/packages/core/x86_64/openssl/

Currently we have "1.0.1.f-2" which is effected as far as I can know.

% pacman -Si openssl Repository : core Name : openssl Version : 1.0.1.g-1 Description : The Open Source toolkit for Secure Sockets Layer and Transport Layer Security Architecture : x86_64 URL : https://www.openssl.org Licenses : custom:BSD Groups : None Provides : None Depends On : zlib perl Optional Deps : ca-certificates Conflicts With : None Replaces : None Download Size : 2317.98 KiB Installed Size : 6217.00 KiB Packager : Pierre Schmitz Build Date : Mon 07 Apr 2014 04:28:06 PM EDT Validated By : MD5 Sum SHA256 Sum Signature https://www.archlinux.org/packages/core/x86_64/openssl/

Currently we have "1.0.1.f-2" which is effected as far as I can know.

pacman -Syu should upgrade it to 1.0.1.g-1? pacman -Q openssl reports that version anyway, which fixes heartbleed. [1] Greetings, Zeger-Jan van de Weg [1] https://www.openssl.org/news/secadv_20140407.txt

Am 08.04.2014 17:29, schrieb Neal Oakey:

Hi,

there is an Bug(1) in OpenSSL 1.0.1 and as far as I'm informed this has only been patched in 1.0.1g. Many other Distributions have build there own patch, what is with us? Currently we have "1.0.1.f-2" which is effected as far as I can know.

Greetings Neal

1) (sry, German) http://www.golem.de/news/sicherheitsluecke-keys-auslesen-mit-openssl-1404-10...

I actually did push an updated package within 3 hours after the public announcement. I think that is pretty reasonable especially since we are not among the fortunate distros and companies that were notified beforehand. Greetings, Pierre -- Pierre Schmitz, https://pierre-schmitz.com

Slightly OT but for those interested, I added the heartbleed utility (used by the heartbleed checker site) to the AUR: https://aur.archlinux.org/packages/heartbleed-git/ % heartbleed mediacru.sh:443 2014/04/08 17:53:57 mediacru.sh:443 - SAFE J. Leclanche On Tue, Apr 8, 2014 at 5:35 PM, Anatol Pomozov wrote:

Hi

On Tue, Apr 8, 2014 at 9:29 AM, Pierre Schmitz wrote:

...

Am 08.04.2014 17:29, schrieb Neal Oakey:

...

Hi,

there is an Bug(1) in OpenSSL 1.0.1 and as far as I'm informed this has only been patched in 1.0.1g. Many other Distributions have build there own patch, what is with us? Currently we have "1.0.1.f-2" which is effected as far as I can know.

Greetings Neal

1) (sry, German) http://www.golem.de/news/sicherheitsluecke-keys-auslesen-mit-openssl-1404-10...

I actually did push an updated package within 3 hours after the public announcement. I think that is pretty reasonable especially since we are not among the fortunate distros and companies that were notified beforehand.

Is there any "secret security list" for distros where such issues are discussed/notified before a vulnerable gets public attention? If there is one then Arch should be added there as well.

I actually did push an updated package within 3 hours after the public announcement. I think that is pretty reasonable especially since we are not among the fortunate distros and companies that were notified beforehand.

It's very good! Only a few distribution and vendors can do that! What is the situation with the Archlinux websites and others servers? I remind that this flaw is rather critical and applying the patch/new version is probably not enough (especially if you are . There is already a lot of people playing with this bug and trying to extract "secrets" and sensitive data from servers. TLS private keys should be revoked and new ones get generated, as htpasswd etc. o/ RbN