Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

Today the heartbleed OpenSSL exploit was announced in the wild, which allows an attacker to surreptitiously detect and steal private server keys (allowing them to MitM and decrypt your encrypted data and steal passwords). This affects OpenSSL versions including 1.0.1f which is the version on my up-to-date Mavericks computer Mac (because I used port/brew to install other software which updated my openssl without me realizing it):

$ openssl version
OpenSSL 1.0.1f 6 Jan 2014

This demonstrates I am not using the Mavericks version of OpenSSL:

$ which openssl
/opt/local/bin/openssl

OpenSSL released a fix today in 1.0.1g and I wonder how I can get this fixed version installed over my current version?

share|improve this question
9  
You are not using the version that came with OS X Mavericks -- that's 0.9.8y, which does not have the heartbleed bug (it was introduced in 1.0.1). Your best update path will depend on where and how you installed the newer version. which openssl might be informative. Also, the major problem isn't the openssl command, it's the openssl libraries (which are used by other programs) -- those aren't API compatible between versions 0.9.x and 1.0.x, so you do not want to update the system-supplied openssl libraries! –  Gordon Davisson Apr 8 at 5:13
    
@GordonDavisson - You are totally right. I was mistaken. I had apparently installed MacPort at some point on this machine which upgraded my openssl. (Probably when I was trying to get python2.7 working). Probably should delete this question, but won't in case others make the same mistake find SapphireSun's great answer useful). –  dr jimbob Apr 8 at 5:31
    
With that clarifying update, I'd leave it. There are probably other people in the same boat, and having this here should give them an idea what needs to be done. –  Gordon Davisson Apr 8 at 5:38
1  
If you install OpenSSL with brew it will not link the binaries to /usr/bin. Therefore it will not be run if you issue an openssl on command line. –  Max Ried Apr 9 at 21:16
    
@MaxRied how do you run the version that homebrew installed? I installed new openssl by instructions in accepted answer, and openssl version returns 1.0.1g, but you're saying openssl commands aren't using that version? –  inorganik Apr 23 at 17:15

2 Answers 2

up vote 24 down vote accepted

For what it's worth, I just used homebrew (http://brew.sh/):

brew update
brew install openssl
brew link --force openssl

openssl version -a

If one of the bad versions come up (1.0.1a-f):

which openssl

Replace with a symlink to /usr/local/Cellar/openssl/1.0.1g/bin/openssl

e.g. in my case openssl was located in /usr/bin

mv /usr/bin/openssl /usr/bin/openssl_OLD
ln -s /usr/local/Cellar/openssl/1.0.1g/bin/openssl /usr/bin/openssl

share|improve this answer
3  
Don't delete the original—just rename it. If you find the Homebrew-built version doesn't work for some purpose, there's no reason to put yourself up a creek without a (working) paddle. –  Terry N Apr 8 at 4:52
1  
Fair enough, but on the other hand, I wouldn't call that version working... –  SapphireSun Apr 8 at 4:59
1  
Even with the vulnerability, it's still useful to you in any situation in which you're willing to take the calculated risk in order to get app X (that depends on it) to work briefly. Or, if you prefer... "working" in the sense that a broken paddle can still push water. :-p –  Terry N Apr 8 at 5:48
1  
Just a note - after performing these steps, typing "openssl" in the terminal window failed with a "no such file or directory" error pointing to the old copy (but it did work in a new terminal window). To fix the terminal window I was working in, I needed to do a: hash -r –  Mike Hedman Apr 11 at 21:28
    
On OS X 10.9.5, I got openssl binary with homebrew, but had to manually create the symlink (the end of the answer). –  Nikolay Tsenkov Oct 1 at 9:47

Or for those who are using mac ports, and are not worried about keeping the version

sudo port upgrade openssl

simples :-)

share|improve this answer
1  
sudo port upgrade outdated also works. –  dr jimbob Apr 8 at 16:51

protected by Community Apr 9 at 21:00

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.