Attention when updating Debian stable (Jessie) or Ubuntu 14.04 LTS (Trusty)

Forums › Technical News

Christian Beer
Christian Beer
Joined: 9 Feb 05
Posts: 595
Credit: 124445674
RAC: 310232

Did you restart after the

1 Mar 2016 15:27:59 UTC
Message 136462
(moderation:
    )

    Did you restart after the update? It may be necessary for BOINC to update the curl/openssl link.

    Thunder
    Thunder
    Joined: 18 Jan 05
    Posts: 138
    Credit: 46754541
    RAC: 0

    RE: Did you restart after

    1 Mar 2016 15:52:46 UTC
    Message 136463 in response to message 136462
    (moderation:
      )

      Quote:
      Did you restart after the update? It may be necessary for BOINC to update the curl/openssl link.

      That did it. Pardon my ignorance, but I couldn't easily figure out how to restart the boinc client, so I just rebooted the system. As soon as I tried a project update it grabbed a couple new tasks.

      SuperSluether
      SuperSluether
      Joined: 1 Sep 14
      Posts: 4
      Credit: 54809605
      RAC: 0

      Are there any possible

      16 Mar 2016 17:54:36 UTC
      Message 136464
      (moderation:
        )

        Are there any possible security risks with holding back this package? Will the package eventually be updated to fix the problem on Debian and Raspbian?

        Christian Beer
        Christian Beer
        Joined: 9 Feb 05
        Posts: 595
        Credit: 124445674
        RAC: 310232

        The Maintainer of the package

        17 Mar 2016 9:00:41 UTC
        Message 136465
        (moderation:
          )

          The Maintainer of the package is working on an update but it there is a systematic problem as it was never anticipated to include a removed certificate again. A security risk is that you have several 1024bit certificates on your computer that use a weak signature. As far as I know there are no attacks going on right now that are aimed at websites using 1024bit certificates. As soon as that is the case we will re-evaluate our advise.

          Christian Beer
          Christian Beer
          Joined: 9 Feb 05
          Posts: 595
          Credit: 124445674
          RAC: 310232

          A new openssl version (that

          19 May 2016 6:26:32 UTC
          Message 136466
          (moderation:
            )

            A new openssl version (that has a fix for this problem) is already accepted into stable proposed updates. It shouldn't be long until this is available in the normal stable repository.

            hartacus
            hartacus
            Joined: 2 May 14
            Posts: 9
            Credit: 4990556
            RAC: 0

            Thanks for the update!

            28 May 2016 0:52:33 UTC
            Message 136467 in response to message 136466
            (moderation:
              )

              Thanks for the update!

              Christian Beer
              Christian Beer
              Joined: 9 Feb 05
              Posts: 595
              Credit: 124445674
              RAC: 310232

              I was informed that with the

              6 Jun 2016 7:12:40 UTC
              Message 136468
              (moderation:
                )

                I was informed that with the update to Debian Jessie 8.5 on June 4th a new OpenSSL version was introduced that fixes the problem with certificate validation. You can now unhold the ca-certificates package and update to 8.5 like this:

                apt-get update
aptitude unhold ca-certificates
apt-get upgrade

                Comment viewing options

                Select your preferred way to display the comments and click "Save settings" to activate your changes.

                Forums › Technical News