OpenSSL 1.0.1e-2+deb7u14 Debian Wheezy 和 CVE-2014-0224

OpenSSL 1.0.1e-2+deb7u14 Debian Wheezy 和 CVE-2014-0224

根据 Debian 安全追踪器,CVE-2014-0224 漏洞已在 OpenSSL 1.0.1e-2+deb7u10 中修复。 https://security-tracker.debian.org/tracker/CVE-2014-0224

我有:

#apt-cache policy openssl
openssl:
  Installed: 1.0.1e-2+deb7u13
  Candidate: 1.0.1e-2+deb7u13

但是当尝试通过 PCI 合规性测试时,它失败了:

Starting Nmap 6.47 ( http://nmap.org ) at 2014-12-
Nmap scan report for static-ip-inaddr.ip-pool.com ()
Host is up (0.11s latency).
PORT    STATE SERVICE
443/tcp open  https
| ssl-ccs-injection:
|   VULNERABLE:
|   SSL/TLS MITM vulnerability (CCS Injection)
|     State: VULNERABLE
|     Risk factor: High
|     Description:
|       OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h
|       does not properly restrict processing of ChangeCipherSpec messages,
|       which allows man-in-the-middle attackers to trigger use of a zero
|       length master key in certain OpenSSL-to-OpenSSL communications, and
|       consequently hijack sessions or obtain sensitive information, via
|       a crafted TLS handshake, aka the "CCS Injection" vulnerability.
|
|     References:
|       http://www.cvedetails.com/cve/2014-0224
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224
|_      http://www.openssl.org/news/secadv_20140605.txt

我应该以某种方式(如何?)在 Debian Wheezy 中安装 OpenSSL 1.0.1h 吗?

我读过相关主题,但不确定是否有可用内容: Debian Wheezy 中的 OpenSSL 问题 在 debian squeeze 中更新 openssl

相关内容