OpenSSL OCSP状态请求扩展存在严重漏洞

问答中心分类: OneinStackOpenSSL OCSP状态请求扩展存在严重漏洞
weiyidu asked 9月 ago

http://bbs.qcloud.com/forum.php?mod=viewthread&tid=22248&extra;=   腾讯的安全预警
OpenSSL 1.0.1e-fips 11 Feb 2013,这是我安装之后查到的版本号
怎么升级呢?

4 Answers
Charles Chin answered 9月 ago

https://www.openssl.org/news/secadv/20160922.txt
官方提示1.0.2升级到1.0.2i。oneinstack带升级脚本吗,还是要自己编译?

Charles Chin answered 9月 ago

我是这样升级的:
(不要用openssl version查看版本号,要用nginx -V查看版本号。)
1、nginx -V查看nginx版本和openssl版本,顺便复制configure arguments后面的全部内容,比如我的是:–prefix=/usr/local/nginx –user=www –group=www –with-http_stub_status_module –with-http_v2_module –with-http_ssl_module –with-ipv6 –with-http_gzip_static_module –with-http_realip_module –with-http_flv_module –with-openssl=../openssl-1.0.2h –with-pcre=../pcre-8.39 –with-pcre-jit –with-ld-opt=-ljemalloc
 
2、cd ~/oneinstack/src
下载对应的nginx:
wget http://mirrors.linuxeye.com/oneinstack/src/nginx-1.10.1.tar.gz
下载对应的openssl:
wget https://www.openssl.org/source/openssl-1.0.2j.tar.gz 
(所有版本在这里 https://www.openssl.org/source/ )
3、解压:
tar xzvf openssl-1.0.2j.tar.gz
tar xzvf nginx-1.10.1.tar.gz
4、编译nginx:
cd nginx-1.10.1
 
./configure –prefix=/usr/local/nginx –user=www –group=www –with-http_stub_status_module –with-http_v2_module –with-http_ssl_module –with-ipv6 –with-http_gzip_static_module –with-http_realip_module –with-http_flv_module –with-openssl=../openssl-1.0.2j –with-pcre=../pcre-8.39 –with-pcre-jit –with-ld-opt=-ljemalloc
(主要修改–with-openssl=../openssl-1.0.2j ,其他不变)
 
make
mv /usr/local/nginx/sbin/nginx{,_`date +%m%d`} #备份现有nginx
cp objs/nginx /usr/local/nginx/sbin/ #更新nginx
nginx -t #检查nginx语法
service nginx restart

weiyidu answered 9月 ago

谢谢……
 

chancat answered 4月 ago

谢谢分享 搞定了 娃哈哈