OpenSSL Security in Short
OpenSSL handles the encryption for most web, mail and VPN servers, and much else that talks over the network. The OpenSSL team grades its own advisories from Low to Critical and announces High and Critical fixes a few days ahead. Most of its flaws are rated Low or Moderate, but the rare serious one (Heartbleed was OpenSSL) affects almost everything.
How to Keep OpenSSL Patched
- Update through your distribution:
apt upgradeordnf upgrade. Don't build OpenSSL yourself unless you have to. - Restart services afterwards. nginx, Apache, Postfix and others keep the old library loaded until they restart.
sudo needrestart(Debian and Ubuntu) lists what still uses the old copy. - Check apps that bring their own copy, such as Docker images and some language runtimes.