Ok, Thats great, it means all you need to do is restart and dependency packages, such as openssh, to reload the lib..
That simple.. right? Look at it this way... I upgraded mysql from 3x to 4x which was a LIB change. I ran revdep-rebuild and it recompiled a few perl apps, and mod_perl too, due to the fact the library changed. This openssl change DID NOT change the functionality, just probably a line or two in the code. It means that just reloading, say openssh, will now call the NEW lib with the security fix and still work just fine...Since the library is always called, there is no need to recompile.. I am not positive on static links however. Theory suggests that a change should be detected, I just don't know how deep revdep-rebuild goes... I don't know of anything that uses openssl statically.. Do you? Most static apps usually ship with that static lib and it would have itself came out with a security alert, right? if YOUR linking things statically, then YOU should know these apps... BTW, I am not a know it all, this is how I understand it to be.. if I am wrong, please tell me as I am not a linux messiah here.. :) > -----Original Message----- > From: Joel Osburn [mailto:[EMAIL PROTECTED] > Sent: Wednesday, October 08, 2003 12:37 PM > To: [EMAIL PROTECTED] > Subject: RE: [gentoo-user] Upgrading OpenSSL > > > No. No old version present. > > files root # qpkg -I -i openssl > dev-libs/openssl-0.9.6k * > Toolkit for SSL v2/v3 and TLS v1 [ http://www.openssl.org/ ] > files root # emerge -s openssl > Searching... > [ Results for search key : openssl ] > [ Applications found : 5 ] > > * dev-libs/openssl > Latest version available: 0.9.6k > Latest version installed: 0.9.6k > Size of downloaded files: 2,132 kB > Homepage: http://www.openssl.org/ > Description: Toolkit for SSL v2/v3 and TLS v1 > <other results snipped> > > > > -----Original Message----- > > From: Jeffrey Smelser [mailto:[EMAIL PROTECTED] > > Sent: Wednesday, October 08, 2003 10:28 AM > > To: [EMAIL PROTECTED] > > Subject: RE: [gentoo-user] Upgrading OpenSSL > > > > > > Check your system, did you keep the old version, which seems > > to be the case, it would be. But why would you need it? its a > > security risk right? > > > > > -- > [EMAIL PROTECTED] mailing list > > -- [EMAIL PROTECTED] mailing list
