Ubuntu – Will Ubuntu 14.04 release security updates for openssl 1.0.1 even after 31st December 2016 or will they move to openssl 1.0.2

14.04opensslSecurityupgrade

The 1.0.1 version is currently only receiving security bug fixes and all support will be discontinued for this version on 31st December 2016.
<Link> as stated in their website.

OpenSSL is installed from the main repository of Ubuntu by default during installation.

As ubuntu 14.04 has long term support. So, should I expect upgraded version of OpenSSL or should we have to upgrade it by ourselves.

Best Answer

The answer to your question appears to be that security updates will be released (backported) as needed through the duration of Trusty LTS support. There are currently no plans to release openssl 1.0.2 for Trusty. According to the posts here only security patches will be released for 1.01 after 2016-12-31. It seems the latest source available is 1.0.1e available here

Why?

Marc Deslauriers (Ubuntu Security Engineer) states: "Ubuntu doesn't typically update to newer software versions. Like most other Linux distros, we backport security patches to the versions of software we ship, whether or not there is still upstream support for it."

So the commitment to security is there.

If you feel the need to upgrade regardless you can obtain the source on this page and compile it yourself. Installation instructions are included in the archive but it's pretty straight forward even if you've never compiled code before.

Note that I'm not recommending this as a course of action, I'm simply attempting to be thorough in covering the possibilities.

  $ ./config
  $ make
  $ make test
  $ make install

Sources:

https://www.openssl.org/source/

Installation instructions included in https://www.openssl.org/source/openssl-1.0.2j.tar.gz

As an alternative you could upgrade to xenial (16.04) which has version 1.0.2g already available or as Seth Arnold (Member Ubuntu Security Team) states here

"16.04 LTS's openssl package is based on a 1.0.2g starting point. If running 16.04 LTS is not an option then perhaps the backportpackage command from the ubuntu-dev-tools package could help you."

Related Question