1

I am confused by all the posts, questions, answers, dropping symlink, linking, heartbleed bug, etc... that exist on updating your OpenSSL on a Mac.

When I run $ openssl version I get OpenSSL 0.9.8zh 14 Jan 2016 but when I run $ brew install openssl I get Warning: openssl 1.0.2l is already installed.

Does this mean I have two versions installed?

What exactly should I do now via HomeBrew?

Is there a clean way of updating it to the newest and bug-free version without all the linking and path changing, etc...?

I am using OS X El Capitan 10.11.6

Mary Jane
  • 148
  • 3
  • 9

1 Answers1

1

You have two versions of OpenSSL installed. There is one that is distributed as part of the operating system, and one that Homebrew has installed. They live at different locations on your Mac.

The Heartbleed bug was introduced to OpenSSL with version 1.0.1. The last version that Apple shipped with OS X is version 0.9.8. So you don't need to update the version that is bundled with the operating system to compensate for Heartbleed, 0.9.8 is not affected by the bug. And if similar bugs are found in the future that do affect 0.9.8 then Apple will release a patch to fix them.

Homebrew has installed its own version either because you asked it to or because it needed it to for another piece of software. The version that Homebrew has installed (1.0.2l) includes the fix for Heartbleed. So you don't need to do anything to compensate for Heartbleed there either.

In general though, you should run brew outdated to look for any packages you've installed through homebrew that are out of date and either run brew uninstall XXXXX if you don't need them or brew upgrade XXXXX to update them if an update is available (replacing XXXXX with the name of the package).

Alistair McMillan
  • 14,187