Today the heartbleed OpenSSL exploit was announced in the wild, which allows an attacker to surreptitiously detect and steal private server keys (allowing them to MitM and decrypt your encrypted data and steal passwords). This affects OpenSSL versions including 1.0.1f which is the version on my
up-to-date Mavericks computer Mac (because I used port/brew to install other software which updated my openssl without me realizing it):
$ openssl version OpenSSL 1.0.1f 6 Jan 2014
This demonstrates I am not using the Mavericks version of OpenSSL:
$ which openssl /opt/local/bin/openssl
OpenSSL released a fix today in 1.0.1g and I wonder how I can get this fixed version installed over my current version?
which opensslmight be informative. Also, the major problem isn't the openssl command, it's the openssl libraries (which are used by other programs) -- those aren't API compatible between versions 0.9.x and 1.0.x, so you do not want to update the system-supplied openssl libraries!
MacPortat some point on this machine which upgraded my openssl. (Probably when I was trying to get python2.7 working). Probably should delete this question, but won't in case others make the same mistake find SapphireSun's great answer useful).
openssl versionreturns 1.0.1g, but you're saying
opensslcommands aren't using that version?