Re: OpenSSL

[Florian Kulzer <florian@molphys.leidenuniv.nl>]

On Thu, Oct 12, 2006 at 11:36:52 +0200, Roger Johansen wrote:
> Hi all,
> 
> system: debian 3.1 with 2.6.8-2-386 kernel.
> 
> 
> I am using openssl and i am wondering if it is secure to use it. When i do a:
> 
> "openssl version" it displays:
> 
> OpenSSL 0.9.7e 25 Oct 2004
> 
> 
> isn't this package very old? if i go to the openssl homepage i can see serveral
> security issues since 2004.

The important thing is that you have the latest update from
security.debian.org; this should be version 0.9.7e-3sarge4. You can
check this with "apt-cache policy openssl".

The Debian changelog at /usr/share/doc/openssl/changelog.Debian.gz will
give you the details which fixes have been implemented/backported by the
Debian security team.

-- 
Regards,
          Florian