Security patching on older Oracle Linux

From: Rich J <rjoralist3_at_society.servebeer.com>
Date: Fri, 29 Jan 2016 08:58:13 -0600
Message-ID: <ed62f2812de0de091f9c653b1927407d_at_society.servebeer.com>


 

Hey all,

So, I'm reading about the new OpenSSL security issue at http://arstechnica.com/security/2016/01/high-severity-bug-in-openssl-allows-attackers-to-decrypt-https-traffic/
[1] and there are a few things I noted. First, it only affects v1.0.2.
Good for me. Second, support for 0.9.8 is done. Potentially bad for me. Third, the yum repos for Oracle Linux 5 stop at 0.9.8. Seemingly worse for me.

My Oracle Linux box has very low exposure internally and no exposure externally, but that doesn't mean future ones will be similarly walled off. What's a DBA/SA to do? Migrating this box to a new OL7 one is frankly a huge undertaking with near-zero return. (The Oracle DB on there is actually the easiest to move!)

Thoughts?
Rich  

Links:



[1]

http://arstechnica.com/security/2016/01/high-severity-bug-in-openssl-allows-attackers-to-decrypt-https-traffic/
--
http://www.freelists.org/webpage/oracle-l
Received on Fri Jan 29 2016 - 15:58:13 CET

Original text of this message