Security OpenSSL OpenSSL 1.1.0e CVE-2017-3733 Security Fix Only

Centmin Mod Nginx only uses OpenSSL 1.0.2+ or LibreSSL 2.4/2.5. Centmin Mod 123.09beta01 supports using OpenSSL 1.1.0+ branch but only if you set it yourself. So this security update for OpenSSL 1.1.0e due in next 24hrs or so doesn't apply to Centmin Mod users, unless you overrode the default OPENSSL_VERSION='1.1.0d' and set LIBRESSL_SWICTH='n' in your persistent config file at /etc/centminmod/custom_config.inc.

i.e. only applies if you have previously set in /etc/centminmod/custom_config.inc prior to nginx recompiles via centmin.sh menu option 4.

Code (Text):

OPENSSL_VERSION='1.1.0d'
LIBRESSL_SWICTH='n'

Updating if you're on OpenSSL 1.1.0d is easy as updating the overridden version in /etc/centminmod/custom_config.inc and then recompiling Nginx via centmin.sh menu option.

Code (Text):

OPENSSL_VERSION='1.1.0e'
LIBRESSL_SWICTH='n'

---

[openssl-announce] Forthcoming OpenSSL release

 

You can tell if your Centmin Mod Nginx is using OpenSSL or LibreSSL via output of SSH command

Code (Text):

nginx -V

If using LibreSSL, built with line will list such

Code (Text):

nginx -V
nginx version: nginx/1.11.10
built by clang 3.4.2 (tags/RELEASE_34/dot2-final)
built with LibreSSL 2.4.5

If using OpenSSL 1.0.2k, built with line will list such

Code (Text):

nginx -V
nginx version: nginx/1.11.10
built by clang 3.4.2 (tags/RELEASE_34/dot2-final)
built with OpenSSL 1.0.2k  26 Jan 2017

You don't need to update to OpenSSL 1.1.0e if you are using either LibreSSL 2.4.5 or OpenSSL 1.0.2k

 

Countdown till Feb 16th 12:00 UTC OpenSSL 1.1.0e Release

 

Actually 1.1.0* regressed compared to 1.0.2* IIRC

LibreSSL is default as it compiles much faster than OpenSSL and less security bugs overall. OpenSSL 1.1.0 compiles faster than OpenSSL 1.0.2 though but isn't compatible with nginx lua-nginx-module module yet

 

haha my own data !

Indeed... if lua nginx module supported OpenSSL 1.1.0, it would be the default version for sure. I should revisit these benchmarks on my i7 4790K server

 

Interesting results https://community.centminmod.com/th...-0e-vs-libressl-2-4-5-2-5-1-benchmarks.10463/ !

 

Some details for the security issue in versions prior to OpenSSL 1.1.0e https://www.openssl.org/news/secadv/20170216.txt