Topic: Users of Bitcoin Core on Linux must not upgrade to the latest version of OpenSSL (Read 66065 times)

So, if someone wanted to destroy a whole bunch of altcoins right now, he could deliberately mine blocks that fail the new SSL check and pass the old SSL check.  They'd all hang when they tried to process the bogus block.

It looks like no altcoins have addressed this.  What does this mean for their vulnerability?  

It looks like no altcoins have addressed this.  What does this mean for their vulnerability? 

iU  libssl1.0.0:amd64                                     1.0.1f-1ubuntu2.7                                   amd64        Secure Sockets Layer toolkit - shared libraries
iF  libssl1.0.0:i386                                      1.0.1f-1ubuntu2.8                                   i386         Secure Sockets Layer toolkit - shared libraries

Without you telling me which dependencies are wrong, no. Most likely, you downgraded only part of your openssl packages, leaving some at the newer version. Make sure that you downgrade them all.

Do a dpkg -l | grep '1.0.1f' so see if there are different versions installed.

Thank you very much for this
But it seems now i can't update & upgrade ubuntu, it says something about wrong dependencies, any solution for that?

You need to search for the version you need, download if for your architecture, and install it manually.

For example, in this case you search for 1.0.1f-1ubuntu2.7. You can find it here: https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.7
Select your architecture and download the .deb package of openssl and libssl (and the -dev packages if you need them). Then install them using dbpg.

Assuming that you're on 64bit:


That's it

how do you downgrade ?

wget https://launchpad.net/~ubuntu-security-proposed/+archive/ubuntu/ppa/+build/6463840/+files/openssl_1.0.1f-1ubuntu2.7_amd64.deb
wget https://launchpad.net/~ubuntu-security-proposed/+archive/ubuntu/ppa/+build/6463840/+files/libssl1.0.0_1.0.1f-1ubuntu2.7_amd64.deb
dpkg -i openssl_1.0.1f-1ubuntu2.7_amd64.deb
dpkg -i libssl1.0.0_1.0.1f-1ubuntu2.7_amd64.deb

Here you go for Ubuntu: this is the security update that backports this patch to Ubuntu 14.10, Ubuntu 14.04 LTS,
Ubuntu 12.04 LTS, and Ubuntu 10.04 LTS: http://www.ubuntu.com/usn/usn-2459-1/

That means: if you are running any of the Ubuntu (server) versions above, you are very likely affected. If you are running Ubuntu LTS, you are for sure affected. In these cases, don't upgrade your OpenSSL installation.

Here's the list of package versions that you should NOT install (that is, the package versions with the backported patch):


How to avoid upgrading accidentally? Simply execute:


PS: don't trust the version reported by
as it does not cover the backports. Execute
to see which version you have.

 lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 14.04.1 LTS
Release:        14.04
Codename:       trusty

dpkg -s openssl | grep Version
Version: 1.0.1f-1ubuntu2.8

At this point, just use 0.9.4.

Too large a codebase of mostly obfuscated spaghetti code.
It's going to be replaced with libsecp256k1 (which we do maintain) "soon" (planned since before this issue).

At this point, just use 0.9.4.

Too large a codebase of mostly obfuscated spaghetti code.
It's going to be replaced with libsecp256k1 (which we do maintain) "soon" (planned since before this issue).

I am develop a trading platform now, I must to compile the bitcoin source code by myself,
so, which version of the openssl I can use? Thanks.

my other question is, why the bitcoin system don't maintain one correct branch of openssl?

Greg Maxwell's announcement:  
http://sourceforge.net/p/bitcoin/mailman/message/33221963/

Summary:

There is a problem with the most recent release of OpenSSL which will cause issues for some users of Bitcoin Core on Linux. This is not a critical security issue, but everyone using Bitcoin Core on Linux should read the following information, especially if you're automatically processing Bitcoin payments. The worst-case scenario is that you might accept transactions as confirmed which are later reversed.

You are likely to be affected only if:

- You use Linux.
- You installed Bitcoin Core using your distro's package manager or you compiled Bitcoin Core yourself without using gitian. You are not affected if you use the binaries on bitcoin.org.
- You upgrade your system's OpenSSL to 1.0.0p or 1.0.1k. These were security-fix releases, so your package manager might have updated them automatically.

If you are affected, then your client might become stuck at a particular block, and you'll have to reindex the block chain to fix it. In some conceivable but unlikely scenarios, you might see incoming transactions as having 6+ confirmations when the transactions are actually invalid. If you are a pool operator, then you could conceivably start mining on a false chain, which would cause you to lose all of your future blocks until you fix this.

If you are using an affected version of Bitcoin Core, you should either make sure that your system OpenSSL does not get updated or shut down Bitcoin Core until an update fixing this is released in a day or two. If Bitcoin Core is already stuck and showing the "We do not appear to fully agree with our peers!" message, shut it down until an update fixing this is released; when you run that version, you'll have to run it with the -reindex switch.

The problem is that distributions tend to backport updates that are marked as security updates (as this one).

Ubuntu 14.10: libssl1.0.0 1.0.1f-1ubuntu9.1 
Ubuntu 14.04 LTS: libssl1.0.0 1.0.1f-1ubuntu2.8 
Ubuntu 12.04 LTS: libssl1.0.0 1.0.1-4ubuntu5.21 
Ubuntu 10.04 LTS: libssl0.9.8 0.9.8k-7ubuntu8.23

sudo apt-mark hold openssl

openssl version

dpkg -s openssl | grep Version

I can confirm that Version 1.0.1f (6 Jan 2014) caused 4 test failures here as well.