137

Today the heartbleed OpenSSL exploit was announced in the wild, which allows an attacker to surreptitiously detect and steal private server keys (allowing them to MitM and decrypt your encrypted data and steal passwords). This affects OpenSSL versions including 1.0.1f which is the version on my up-to-date Mavericks computer Mac (because I used port/brew to install other software which updated my openssl without me realizing it):

$ openssl version
OpenSSL 1.0.1f 6 Jan 2014

This demonstrates I am not using the Mavericks version of OpenSSL:

$ which openssl
/opt/local/bin/openssl

OpenSSL released a fix today in 1.0.1g and I wonder how I can get this fixed version installed over my current version?

Improve this question
6
  • 17
    You are not using the version that came with OS X Mavericks -- that's 0.9.8y, which does not have the heartbleed bug (it was introduced in 1.0.1). Your best update path will depend on where and how you installed the newer version. which openssl might be informative. Also, the major problem isn't the openssl command, it's the openssl libraries (which are used by other programs) -- those aren't API compatible between versions 0.9.x and 1.0.x, so you do not want to update the system-supplied openssl libraries!
    – Gordon Davisson
    Commented Apr 8, 2014 at 5:13
  • @GordonDavisson - You are totally right. I was mistaken. I had apparently installed MacPort at some point on this machine which upgraded my openssl. (Probably when I was trying to get python2.7 working). Probably should delete this question, but won't in case others make the same mistake find SapphireSun's great answer useful).
    – dr jimbob
    Commented Apr 8, 2014 at 5:31
  • With that clarifying update, I'd leave it. There are probably other people in the same boat, and having this here should give them an idea what needs to be done.
    – Gordon Davisson
    Commented Apr 8, 2014 at 5:38
  • 2
    If you install OpenSSL with brew it will not link the binaries to /usr/bin. Therefore it will not be run if you issue an openssl on command line.
    – bot47
    Commented Apr 9, 2014 at 21:16
  • When you install openssl with brew, it'll tell you, that it won't link it, as they fear this would break some OS X internals.
    – bot47
    Commented Apr 23, 2014 at 17:41

4 Answers 4

Reset to default
159

For what it's worth, I just used homebrew (http://brew.sh/):

brew update  
brew install openssl  
brew link --force openssl 
openssl version -a

If one of the bad versions come up (1.0.1a-f), you can figure out which version of openssl you're using, this way:

which openssl

Often this is from /usr/bin. To make sure you get the updated version, drop a symlink into /usr/local/bin to point to the updated openssl, like this: 

ln -s /usr/local/Cellar/openssl/1.0.1g/bin/openssl /usr/local/bin/openssl

As an alternative to that final step, some people replace the openssl in /usr/bin with a symlink to /usr/local/Cellar/openssl/1.0.1g/bin/openssl (or whatever your version is): 

mv /usr/bin/openssl /usr/bin/openssl_OLD  
ln -s /usr/local/Cellar/openssl/1.0.1g/bin/openssl /usr/bin/openssl

But this is known to cause problems with some more recent versions of OSX. Better to just insert a new symlink into /usr/local/bin, which should take precedence on your path over /usr/bin.

Improve this answer
16
  • 9
    Don't delete the original—just rename it. If you find the Homebrew-built version doesn't work for some purpose, there's no reason to put yourself up a creek without a (working) paddle.
    – Terry N
    Commented Apr 8, 2014 at 4:52
  • 1
    Fair enough, but on the other hand, I wouldn't call that version working...
    – SapphireSun
    Commented Apr 8, 2014 at 4:59
  • 1
    Even with the vulnerability, it's still useful to you in any situation in which you're willing to take the calculated risk in order to get app X (that depends on it) to work briefly. Or, if you prefer... "working" in the sense that a broken paddle can still push water. :-p
    – Terry N
    Commented Apr 8, 2014 at 5:48
  • 8
    Just a note - after performing these steps, typing "openssl" in the terminal window failed with a "no such file or directory" error pointing to the old copy (but it did work in a new terminal window). To fix the terminal window I was working in, I needed to do a: hash -r
    – Mike Hedman
    Commented Apr 11, 2014 at 21:28
  • 7
    Better than creating a symlink at /usr/bin/openssl, one can create the link at /usr/local/bin/openssl. That should precede /usr/bin on your $PATH and bypass any problems arising from "System Integrity Protection" in newer versions of OS X.
    – mrKelley
    Commented Apr 5, 2016 at 20:45
14

Or for those who are using mac ports, and are not worried about keeping the version

sudo port upgrade openssl

simples :-)

Improve this answer
3
  • 3
    sudo port upgrade outdated also works.
    – dr jimbob
    Commented Apr 8, 2014 at 16:51
  • 1
    That's funny, having both macports and brew both install openssl on my machine was actually the cause of this happening to me. Running sudo port -f uninstall openssl @<old-version> did the trick for me :)
    – yair
    Commented Mar 14, 2016 at 22:51
  • @yair having both macports and homebrew will cause many problems
    – mmmmmm
    Commented May 26, 2016 at 10:45
6

For resolving OCSP Status Request extension unbounded memory growth (CVE-2016-6304) on macOS Sierra using brew with System Integrity Protection enabled:

  1. Temporarily adjust permissions on /usr/local so brew can update:

    sudo chgrp -R admin /usr/local
sudo chmod -R g+w /usr/local

  2. Install the updated version of OpenSSL (you probably want 1.0.2i):

    brew install openssl

  3. You may want/need to delete an existing symlink to openssl from /usr/local/bin:

    rm /usr/local/bin/openssl

  4. Re-link the proper brew version:

    sudo ln -s /usr/local/Cellar/openssl/1.0.2i/bin/openssl /usr/local/bin/openssl

  5. Restore original permissions on /usr/local/bin:

    sudo chown root:wheel /usr/local
Improve this answer
8
  • In my case old version of OpneSSL is located in /usr/bin. It is failing when trying to change bin permission.
    – Ramis
    Commented Oct 4, 2016 at 8:02
  • Are you using Sudo?
    – brandonscript
    Commented Oct 4, 2016 at 14:07
  • Yes. I used sudo. I found comment that in the latest version os OS X here is no way to change permission of this file. So I stop achieving it.
    – Ramis
    Commented Oct 4, 2016 at 17:36
  • Why not just change your $PATH variable to look in /usr/local/bin?
    – brandonscript
    Commented Oct 4, 2016 at 18:02
  • Hi everyone, I am confused by all the answers, dropping symlink, linking, heartbleed bug, etc... When I run $ openssl version I get OpenSSL 0.9.8zh 14 Jan 2016 but when I run $ brew install openssl I get Warning: openssl 1.0.2l is already installed. Does this mean I have two versions installed? What exactly should I do now?
    – Mary Jane
    Commented Sep 18, 2017 at 8:09
3

Whoever doesn't want to use brew or ports and just wants to replace the default OpenSSL 0.9.8 installation can always disable system integrity protection by rebooting into recovery mode (cmd+R) and issuing

csrutil disable

and afterwards compile openssl with

./config --prefix=/usr
make install

It successfully replaced OpenSSL in ElCapitan for me and I was able to compile curl and apache's httpd 2.4 without any issue directly from sources. The reasoning behind the method some might consider drastic is that ElCapitan is no longer maintained by Apple and no updates are forthcoming so it likely won't break. Secondly, it saves you from pointing to openssl folder in /usr/local for every program you compile making compilation more robust.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .