# Heartbleed and SuSE Servers! **URL:** \ **Category:** SLES Configure-Administer\ **Created:** [April 10, 2014, 6:10pm UTC](https://forums.suse.com/t/heartbleed-and-suse-servers/25368 "2014-04-10T18:10:31Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![ddgaikwad](https://avatars.discourse-cdn.com/v4/letter/d/d07c76/32.png) [@ddgaikwad](https://forums.suse.com/u/ddgaikwad)\ **Post date:** [April 10, 2014, 6:10pm UTC](https://forums.suse.com/t/heartbleed-and-suse-servers/25368/1 "2014-04-10T18:10:31Z")
Hi Guys! Recently there has a been a lot of news about this new vulnerability being reported. I went through this document: [http://www.novell.com/support/kb/doc.php?id=7014878](http://www.novell.com/support/kb/doc.php?id=7014878) and it does tell you that there is nothing worry since our components do not use OpenSSL. I was wondering if there is way where I can manually check and confirm if my SuSE Servers are safe from this vulnerability? Any pointers? Any other methods? Thank you, - ddgaikwad ---
**Author:** ![Jens-U](https://avatars.discourse-cdn.com/v4/letter/j/d78d45/32.png) [@Jens-U](https://forums.suse.com/u/Jens-U)\ **Post date:** [April 10, 2014, 6:27pm UTC](https://forums.suse.com/t/heartbleed-and-suse-servers/25368/2 "2014-04-10T18:27:45Z")
Hi ddgaikwad, [QUOTE=ddgaikwad;20416]Hi Guys! Recently there has a been a lot of news about this new vulnerability being reported. I went through this document: [http://www.novell.com/support/kb/doc.php?id=7014878](http://www.novell.com/support/kb/doc.php?id=7014878) and it does tell you that there is nothing worry since our components do not use OpenSSL. I was wondering if there is way where I can manually check and confirm if my SuSE Servers are safe from this vulnerability? Any pointers? Any other methods? Thank you, - ddgaikwad[/QUOTE] from that TID you referenced (it may have been updated since you loaded it): > [@](#): > > To test whether your site is vulnerable, simply go to [https://www.ssllabs.com/ssltest](https://www.ssllabs.com/ssltest) and put in your public domain in there before running the test. And SLES indeed does provide Openssl libraries - just in an unaffected version… Regards, Jens ---
**Author:** ![malcolmlewis](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/malcolmlewis/32/11375_2.png) [@malcolmlewis](https://forums.suse.com/u/malcolmlewis)\ **Post date:** [April 10, 2014, 6:28pm UTC](https://forums.suse.com/t/heartbleed-and-suse-servers/25368/3 "2014-04-10T18:28:02Z")
> [@](#): > > On Thu 10 Apr 2014 03:14:01 PM CDT, ddgaikwad wrote: > > Hi Guys! > > Recently there has a been a lot of news about this new vulnerability > being reported. > I went through this document: > [http://www.novell.com/support/kb/doc.php?id=7014878](http://www.novell.com/support/kb/doc.php?id=7014878) and it does tell you > that there is nothing worry since our components do not use OpenSSL. > > I was wondering if there is way where I can manually check and confirm > if my SuSE Servers are safe from this vulnerability? > > Any pointers? > Any other methods? > > Thank you, > > - ddgaikwad Hi I used this PoC [https://gist.github.com/sh1n0b1/10100394](https://gist.github.com/sh1n0b1/10100394) – Cheers Malcolm °¿° SUSE Knowledge Partner (Linux Counter #276890) openSUSE 13.1 (Bottle) (x86\_64) GNOME 3.10.1 Kernel 3.11.10-7-desktop If you find this post helpful and are logged into the web interface, please show your appreciation and click on the star below… Thanks! ---
**Author:** ![ab1](https://avatars.discourse-cdn.com/v4/letter/a/d2c977/32.png) [@ab1](https://forums.suse.com/u/ab1)\ **Post date:** [April 10, 2014, 6:45pm UTC](https://forums.suse.com/t/heartbleed-and-suse-servers/25368/4 "2014-04-10T18:45:37Z")
Just ask the OS which version of OpenSSL it is using (0.9.8) and then compare with the affected version (1.0.1 through 1.0.1f) and you’re done. rpm -qi openssl – Good luck. If you find this post helpful and are logged into the web interface, show your appreciation and click on the star below… ---
**Author:** ![smflood](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/smflood/32/10576_2.png) [@smflood](https://forums.suse.com/u/smflood)\ **Post date:** [April 11, 2014, 1:13pm UTC](https://forums.suse.com/t/heartbleed-and-suse-servers/25368/5 "2014-04-11T13:13:07Z")
On 10/04/2014 16:45, ab wrote: [color=blue] > Just ask the OS which version of OpenSSL it is using (0.9.8) and then > compare with the affected version (1.0.1 through 1.0.1f) and you’re done. > > rpm -qi openssl[/color] Just because OpenSSL 1.0.1 through 1.0.1f is vulnerable doesn’t mean that if “rpm -qi openssl” reports 1.0.1 through 1.0.1f then you are vulnerable since it’s possible that you might have a packaged version of OpenSSL with relevant fix(es) implemented. This is the case with openSUSE 12.3 and 13.1 where they had and still have OpenSSL 1.0.1e but the difference is latest packages include fix for Heartbleed vulnerability. ## HTH. Simon SUSE Knowledge Partner * * * ## If you find this post helpful and are logged into the web interface, please show your appreciation and click on the star below. Thanks. ---
**Author:** ![ab1](https://avatars.discourse-cdn.com/v4/letter/a/d2c977/32.png) [@ab1](https://forums.suse.com/u/ab1)\ **Post date:** [April 11, 2014, 1:52pm UTC](https://forums.suse.com/t/heartbleed-and-suse-servers/25368/6 "2014-04-11T13:52:35Z")
> Just because OpenSSL 1.0.1 through 1.0.1f is vulnerable doesn’t mean[color=blue] > that if “rpm -qi openssl” reports 1.0.1 through 1.0.1f then you are > vulnerable since it’s possible that you might have a packaged version > of OpenSSL with relevant fix(es) implemented. > > This is the case with openSUSE 12.3 and 13.1 where they had and still > have OpenSSL 1.0.1e but the difference is latest packages include fix > for Heartbleed vulnerability.[/color] Well-noted, but this is a SLE forum, and while being on 1.0.1e (or even up through 1.0.1f) does not mean you are vulnerable, NOT being on 1.0.1 at all DOES mean you are not vulnerable in all cases just like being on 1.0.1g or later. In SLE, you’re on 0.9.8. – Good luck. If you find this post helpful and are logged into the web interface, show your appreciation and click on the star below…