Determine Effective Security Version when faced with Backpatching?

Question

The Heartbleed bug has a lot of people asking how to check the version of an installed package. I'm included since I have not discovered a way.

Unfortunately, backpatching has made version checking nearly useless because the info remains at the downlevel. For example (from Fedora):

$ openssl version -a
OpenSSL 1.0.1e-fips 11 Feb 2013
built on: Tue Apr  8 00:29:11 UTC 2014
platform: linux-x86_64
options:  bn(64,64) md2(int) rc4(16x,int) des(idx,cisc,16,int) idea(int) ...
compiler: gcc -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT ...
OPENSSLDIR: "/etc/pki/tls"
engines:  dynamic 

And Yum and Apt-Get are no better because they do not provide an effective security version (from Fedora with Yum):

$ yum info openssl
Loaded plugins: langpacks, refresh-packagekit
Installed Packages
Name        : openssl
Arch        : x86_64
Epoch       : 1
Version     : 1.0.1e
Release     : 37.fc19.1
Size        : 1.5 M
Repo        : installed
From repo   : updates
Summary     : Utilities from the general purpose cryptography library with TLS
            : implementation
URL         : http://www.openssl.org/
License     : OpenSSL
Description : The OpenSSL toolkit provides support for secure communications
            : between machines. OpenSSL includes a certificate management tool
            : and shared libraries which provide various cryptographic
            : algorithms and protocols.

And (from Ubuntu and Apt-Cache):

$ apt-cache showpkg openssl
Package: openssl
Versions: 
1.0.1e-3ubuntu1.2 (/var/lib/apt/lists/us.archive.ubuntu.com_ubuntu_dists_saucy-updates_main_binary-amd64_Packages) (/var/lib/apt/lists/security.ubuntu.com_ubuntu_dists_saucy-security_main_binary-amd64_Packages) (/var/lib/dpkg/status)
 Description Language: 
                 File: /var/lib/apt/lists/us.archive.ubuntu.com_ubuntu_dists_saucy_main_binary-amd64_Packages
                  MD5: 977022bc5545601176b69704acc5df9b
 Description Language: en
                 File: /var/lib/apt/lists/us.archive.ubuntu.com_ubuntu_dists_saucy_main_i18n_Translation-en
                  MD5: 977022bc5545601176b69704acc5df9b

1.0.1e-3ubuntu1 (/var/lib/apt/lists/us.archive.ubuntu.com_ubuntu_dists_saucy_main_binary-amd64_Packages)
 ...
Provides: 
1.0.1e-3ubuntu1.2 - 
1.0.1e-3ubuntu1 - 

As can be seen above, there's no information available on the effective security version ("1.0.1g"). The only information provided is that OpenSSL is downlevel ("1.0.1e") and possibly vulnerable to the latest bug.

Backpatching and downlevel version numbers has got to be one of the dumbest security decisions in history. Its right up there with
(1) opportunistic encryption is bad, plain text is good (browsers), and
(2) using public information as a secret/challenge question.

How does one determine the effective security version of a package that has been backpatched when using Yum and Apt-Get? (This is a generalized question, and not particular to OpenSSL).

Answer 1

I use rpm -q openssl --changelog | head

From this you can check the security patches, and depending on your repository it can give you an accurate version (depending how well commented it was).

I prefer this rather than simply going on build date and assuming that it contains the latest security patch

Since you specifically asked about doing it from yum, first you need to install changelog yum install yum-changelog

Then run yum changelog openssl, or to view while/before updating, yum update openssl --changelog

Out of interest I did a quick search to see if there was any other way to do it, but all I found was someone like yourself who wanted an easy way to check the security version, and he wrote a shell script to do it for any package (linked below)

Blog entry

Shell script

apt-get also (aparently) has a changelog feature by running apt-get changelog openssl
(I say apparently, because I have not tested this myself - some sources quote using aptitude changelog <package> instead)

dpkg has a tool included with the dpkg-dev package called dpkg-parsechangelog
(Again, I have not used this myself so I don't know what results it would provide, but I would guess similar information)

Addendum: The only easy way I could find of resolving the problem of a changelog providing the CVE and not a specific version is with the use of a tool such as vFeed.
I haven't actually used this particular tool (there may be others), but it provides command-line access to functions such as
get_cve : basic CVE attributes (summary, published and modified dates)

If someone had the time or inclination, I'm sure a simple shell script could be written which will combine the extraction of CVE information from the changelog and feed it into a tool such as vFeed, giving you a one-liner answer to the the question "Does package-x contain the latest security patches?".
In fact, most of the work is probably already done in the shell script I linked to previously..

Answer 2

The most reliable way I have found to check the effective status of openssl is to run openssl version -a and look at the built on field. This date, paired with official Ubuntu/Fedora security bullettins, will provide the information you are looking for.

And I somehow agree with you on the backpatching, I must say that it can be confusing.