OpenSSL 'ChangeCipherSpec' Vulnerability in NagiosXI

[igsadmin]

Hi Guys,

My Nagios XI affected OpenSSL 'ChangeCipherSpec' Vulnerability, here is my openssl version,

[root@localhost ~]# rpm -qi openssl
Name : openssl Relocations: (not relocatable)
Version : 1.0.1e Vendor: CentOS
Release : 16.el6_5.4 Build Date: Thu 09 Jan 2014 02:44:56 AM MYT
Install Date: Wed 12 Feb 2014 07:24:25 PM MYT Build Host: c6b9.bsys.dev.centos.org
Group : System Environment/Libraries Source RPM: openssl-1.0.1e-16.el6_5.4.src.rpm
Size : 4205553 License: OpenSSL
Signature : RSA/SHA1, Thu 09 Jan 2014 06:58:54 AM MYT, Key ID 0946fca2c105b9de
Packager : CentOS BuildSystem <http://bugs.centos.org>
URL : http://www.openssl.org/
Summary : A general purpose cryptography library with TLS implementation
Description :
The OpenSSL toolkit provides support for secure communications between
machines. OpenSSL includes a certificate management tool and shared
libraries which provide various cryptographic algorithms and
protocols.

I'm trying to run yum update openssl, but came out this error.

[root@localhost ~]# yum update openssl
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
Could not get metalink https://mirrors.fedoraproject.org/metal ... =epel-6&ar ch=x86_64 error was
14: problem making ssl connection
* base: centos.exabytes.com.my
* epel: mirror.smartmedia.net.id
* extras: centos.biz.net.id
* rpmforge: mirror-fpt-telecom.fpt.net
* updates: mirror.smartmedia.net.id
Setting up Update Process
Resolving Dependencies
--> Running transaction check
---> Package openssl.x86_64 0:1.0.1e-16.el6_5.4 will be updated
--> Processing Dependency: openssl = 1.0.1e-16.el6_5.4 for package: openssl-deve l-1.0.1e-16.el6_5.4.x86_64
---> Package openssl.x86_64 0:1.0.1e-30.el6_6.2 will be an update
--> Running transaction check
---> Package openssl-devel.x86_64 0:1.0.1e-16.el6_5.4 will be updated
---> Package openssl-devel.x86_64 0:1.0.1e-30.el6_6.2 will be an update
--> Finished Dependency Resolution

Dependencies Resolved

================================================================================
Package Arch Version Repository
Size
================================================================================
Updating:
openssl x86_64 1.0.1e-30.el6_6.2 cr 1.5 M
Updating for dependencies:
openssl-devel x86_64 1.0.1e-30.el6_6.2 cr 1.2 M

Transaction Summary
================================================================================
Upgrade 2 Package(s)

Total download size: 2.7 M
Is this ok [y/N]: y
Downloading Packages:
http://mirror.centos.org/centos/6/cr/x8 ... x86_64.rpm: [Errno 14] PYCURL ERROR 22 - "The requested URL returned error: 404 Not Found"
Trying other mirror.
http://mirror.centos.org/centos/6/cr/x8 ... x86_64.rpm: [Errno 14] PYCURL ERROR 22 - "The requested URL returned error: 404 Not Found"
Trying other mirror.


Error Downloading Packages:
openssl-1.0.1e-30.el6_6.2.x86_64: failure: Packages/openssl-1.0.1e-30.el6_6.2.x86_64.rpm from cr: [Errno 256] No more mirrors to try.
openssl-devel-1.0.1e-30.el6_6.2.x86_64: failure: Packages/openssl-devel-1.0.1e-30.el6_6.2.x86_64.rpm from cr: [Errno 256] No more mirrors to try.

My NagiosXi version "Nagios XI 2014R1.5"

[sreinhardt]

It appears as though your request to yum failed to pull down the packages. Currently, there are no known issues with updating openssl, it just appears as though either external dns did not resolve, or the version you requested may be outdated slightly and they have moved to a new one. Does this system have internet access?

[igsadmin]

It appears as though your request to yum failed to pull down the packages. Currently, there are no known issues with updating openssl, it just appears as though either external dns did not resolve, or the version you requested may be outdated slightly and they have moved to a new one. Does this system have internet access?

After configured the system have internet access.
I can upgrade my openssl from openssl-1.0.1e-16.el6_5.4.x86_64 to openssl-1.0.1e-30.el6_6.4.x86_64

Thanks.