121

Today the heartbleed OpenSSL exploit was announced in the wild, which allows an attacker to surreptitiously detect and steal private server keys (allowing them to MitM and decrypt your encrypted data and steal passwords). This affects OpenSSL versions including 1.0.1f which is the version on my up-to-date Mavericks computer Mac (because I used port/brew to install other software which updated my openssl without me realizing it):

$ openssl version
OpenSSL 1.0.1f 6 Jan 2014

This demonstrates I am not using the Mavericks version of OpenSSL:

$ which openssl
/opt/local/bin/openssl

OpenSSL released a fix today in 1.0.1g and I wonder how I can get this fixed version installed over my current version?

  • 16
    You are not using the version that came with OS X Mavericks -- that's 0.9.8y, which does not have the heartbleed bug (it was introduced in 1.0.1). Your best update path will depend on where and how you installed the newer version. which openssl might be informative. Also, the major problem isn't the openssl command, it's the openssl libraries (which are used by other programs) -- those aren't API compatible between versions 0.9.x and 1.0.x, so you do not want to update the system-supplied openssl libraries! – Gordon Davisson Apr 8 '14 at 5:13
  • @GordonDavisson - You are totally right. I was mistaken. I had apparently installed MacPort at some point on this machine which upgraded my openssl. (Probably when I was trying to get python2.7 working). Probably should delete this question, but won't in case others make the same mistake find SapphireSun's great answer useful). – dr jimbob Apr 8 '14 at 5:31
  • With that clarifying update, I'd leave it. There are probably other people in the same boat, and having this here should give them an idea what needs to be done. – Gordon Davisson Apr 8 '14 at 5:38
  • 2
    If you install OpenSSL with brew it will not link the binaries to /usr/bin. Therefore it will not be run if you issue an openssl on command line. – Max Ried Apr 9 '14 at 21:16
  • @MaxRied how do you run the version that homebrew installed? I installed new openssl by instructions in accepted answer, and openssl version returns 1.0.1g, but you're saying openssl commands aren't using that version? – inorganik Apr 23 '14 at 17:15
143

For what it's worth, I just used homebrew (http://brew.sh/):

brew update  
brew install openssl  
brew link --force openssl 
openssl version -a  

If one of the bad versions come up (1.0.1a-f), you can figure out which version of openssl you're using, this way:

which openssl

Often this is from /usr/bin. To make sure you get the updated version, drop a symlink into /usr/local/bin to point to the updated openssl, like this:

ln -s /usr/local/Cellar/openssl/1.0.1g/bin/openssl /usr/local/bin/openssl

As an alternative to that final step, some people replace the openssl in /usr/bin with a symlink to /usr/local/Cellar/openssl/1.0.1g/bin/openssl (or whatever your version is):

mv /usr/bin/openssl /usr/bin/openssl_OLD  
ln -s /usr/local/Cellar/openssl/1.0.1g/bin/openssl /usr/bin/openssl

But this is known to cause problems with some more recent versions of OSX. Better to just insert a new symlink into /usr/local/bin, which should take precedence on your path over /usr/bin.

  • 7
    Don't delete the original—just rename it. If you find the Homebrew-built version doesn't work for some purpose, there's no reason to put yourself up a creek without a (working) paddle. – Terry N Apr 8 '14 at 4:52
  • 1
    Fair enough, but on the other hand, I wouldn't call that version working... – SapphireSun Apr 8 '14 at 4:59
  • 1
    Even with the vulnerability, it's still useful to you in any situation in which you're willing to take the calculated risk in order to get app X (that depends on it) to work briefly. Or, if you prefer... "working" in the sense that a broken paddle can still push water. :-p – Terry N Apr 8 '14 at 5:48
  • 8
    Just a note - after performing these steps, typing "openssl" in the terminal window failed with a "no such file or directory" error pointing to the old copy (but it did work in a new terminal window). To fix the terminal window I was working in, I needed to do a: hash -r – Mike Hedman Apr 11 '14 at 21:28
  • 6
    Better than creating a symlink at /usr/bin/openssl, one can create the link at /usr/local/bin/openssl. That should precede /usr/bin on your $PATH and bypass any problems arising from "System Integrity Protection" in newer versions of OS X. – mrKelley Apr 5 '16 at 20:45
13

Or for those who are using mac ports, and are not worried about keeping the version

sudo port upgrade openssl

simples :-)

  • 3
    sudo port upgrade outdated also works. – dr jimbob Apr 8 '14 at 16:51
  • 1
    That's funny, having both macports and brew both install openssl on my machine was actually the cause of this happening to me. Running sudo port -f uninstall openssl @<old-version> did the trick for me :) – yair Mar 14 '16 at 22:51
  • @yair having both macports and homebrew will cause many problems – Mark May 26 '16 at 10:45
6

For resolving OCSP Status Request extension unbounded memory growth (CVE-2016-6304) on macOS Sierra using brew with System Integrity Protection enabled:

  1. Temporarily adjust permissions on /usr/local so brew can update:

    sudo chgrp -R admin /usr/local
    sudo chmod -R g+w /usr/local
    
  2. Install the updated version of OpenSSL (you probably want 1.0.2i):

    brew install openssl
    
  3. You may want/need to delete an existing symlink to openssl from /usr/local/bin:

    rm /usr/local/bin/openssl
    
  4. Re-link the proper brew version:

    sudo ln -s /usr/local/Cellar/openssl/1.0.2i/bin/openssl /usr/local/bin/openssl
    
  5. Restore original permissions on /usr/local/bin:

    sudo chown root:wheel /usr/local
    
  • In my case old version of OpneSSL is located in /usr/bin. It is failing when trying to change bin permission. – Ramis Oct 4 '16 at 8:02
  • Are you using Sudo? – brandonscript Oct 4 '16 at 14:07
  • Yes. I used sudo. I found comment that in the latest version os OS X here is no way to change permission of this file. So I stop achieving it. – Ramis Oct 4 '16 at 17:36
  • Why not just change your $PATH variable to look in /usr/local/bin? – brandonscript Oct 4 '16 at 18:02
  • Hi everyone, I am confused by all the answers, dropping symlink, linking, heartbleed bug, etc... When I run $ openssl version I get OpenSSL 0.9.8zh 14 Jan 2016 but when I run $ brew install openssl I get Warning: openssl 1.0.2l is already installed. Does this mean I have two versions installed? What exactly should I do now? – Joshua Sep 18 '17 at 8:09
1

Whoever doesn't want to use brew or ports and just wants to replace the default OpenSSL 0.9.8 installation can always disable system integrity protection by rebooting into recovery mode (cmd+R) and issuing

csrutil disable

and afterwards compile openssl with

./config --prefix=/usr
make install

It successfully replaced OpenSSL in ElCapitan for me and I was able to compile curl and apache's httpd 2.4 without any issue directly from sources. The reasoning behind the method some might consider drastic is that ElCapitan is no longer maintained by Apple and no updates are forthcoming so it likely won't break. Secondly, it saves you from pointing to openssl folder in /usr/local for every program you compile making compilation more robust.

protected by Community Apr 9 '14 at 21:00

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.