<html><head/><body><html><head></head><body>Replacing openssl and the certs should be an effective patch. You can always check by running ldd against the stunnel binary to confirm it is linking to a specific SSL library.<br>
<br>
There is also some consideration that you must assume systems were compromised and snooped and change all passwords as well...<br>
Regards,<br>
KAM<br><br><div class="gmail_quote">Koenraad Lelong <stunnel@ace-electronics.be> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre style="white-space: pre-wrap; word-wrap:break-word; font-family: sans-serif; margin-top: 0px">op 10-04-14 12:15, Koenraad Lelong schreef:<br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;">op 08-04-14 16:58, Burak Say schreef:<br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #ad7fa8; padding-left: 1ex;">Hello,<br /><br />When do you think you can release a patch to use OpenSSL 1.0.1g instead<br />of 1.0.1f?</blockquote><br /><br />Hi,<br /><br />I would like to know if I'm safe when I installed the latest<br />openssl-libraries comming from ubuntu (for 12.04LTS). Or do I need to<br />update stunnel also ? The ubuntu package for the latest stunnel seems<br />unavailable right now.<br /><br />Regards,<br /><br />Koenraad.</blockquote><br />I just thought of looking in the package-manager. This says stunnel <br />depends on libssl1.0.0 (installed 1.0.1-4ubun!
tu5.12)
and on openssl <br />(installed 1.0.1-4ubuntu5.12).<br />So I presume I can generate new certificates.<br /><br />Koenraad.<br /><br /><hr /><br />stunnel-users mailing list<br />stunnel-users@stunnel.org<br /><a href="https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users">https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users</a><br /></pre></blockquote></div></body></html></body></html>