Please update your system - dangerous security flaw

[miket]

Hi !

I had to refresh mintUpdate in Daryna twice to see this update; Elyssa had no problem it was there waiting for me to update.

I think the worrying thing here is that if I relied solely on Mint-Update I would miss out on a lot updates for packages which I have installed/use.

At least having apt on the CLI it gives me the ability to check what is going on

Mike.

[Ambystoma]

I got an email warning from my uni's ITS office today, but sort of blew it off 'til I saw it here on the forums. Everything worked fine for me on Daryna using mintupdate. All the updates showed up and were installed. Thanks for the heads up.

[Sakonim]

I just saw ssl-cert being held back when I installed something from the command line. I refreshed mint-update a couple of times but didn't see it appear. I ended up doing 'aptitude safe-upgrade' just to be on the safe side.

Edit - Actually doing 'aptitude safe-upgrade' didn't solve it. Upgrading from synaptic worked.

[red-e-made]

OK, I checked everything and I'm pretty sure I'm well upgraded. But I wanted to direct a question to Husse.

I found this article from a Metafilter thread on this very topic, and I'm curious to know, should we be following the procedures listed in the LiveJournal article as well?

Also, is there something else we need to do if we feel we've been breached before installing the updates, or will installing the updates be enough? I ask because the link you provided advises to not only install the updates but to also "regenerate private keys". I have no idea what this means. Can anyone explain?

[Husse]

If you updated and don't have any keys then you're ok
I did not find any here in my system

[red-e-made]

If you updated and don't have any keys then you're ok
I did not find any here in my system

Sorry, I don't know what "keys" means in this context. Or maybe I do, by a different name. Can you elaborate?

[Sakonim]

I'm giving the Elyssa beta (032) a spin (looks very impessive so far) but I've encountered the same problem there. Not all of the important openssl updates are being detected by mint-update. Isn't this bit of a security risk? What is the official method of updating the system in these circumstances?

[Husse]

Install the latest mintUpdate - it should fix the "do not find" problem
keys in this connection is what's used in a ssl connection with your bank or so. But I think the keys are generated by the bank server

[Sakonim]

How would I install the latest version of mintupdate on Daryna. Is that possible?