openSSL 0.9.8 clean or not, is a Backport in need?

[Schnulli]

Hi @all
Topic openSSL Heartleak(Backdoor)

is openSSL 0.9.8 clean or not, is a Backport in need?

I investigated that Version 0.9.8 seems to be clean....... should it be usefull to switch back and have it again safely working?

Anyone ideas?


Best regards

SN

[gerdesj]

0.9.8 is "clean" with regards Heartbleed but will lack additional features and bug fixes that the later versions have. 0.9.8y is the only version in the tree.

1.0.1g is available and has the fix included in it.

All other versions of OpenSSL are either unavailable in Portage or masked.

It's your choice which to use - personally I use 1.0.1g. If you are not running a server then note that Chrome and Firefox use NSS and not OpenSSL so your exposure will be minimal. Email clients on the other hand ...

Cheers
Jon

PS A more specific question may get the answer you are looking for

[Schnulli]

Hi to UK,
naa, dont need a Discussion, just to have it discussed, google and other bots will find it now (sorry) We all know that most Linux (and other Systems) Users cannot use our nice working Gentoo SSL


Regards and a good day from Germany to UK

SN