LiteSpeed Blog / Products / LiteSpeed Web Server / LiteSpeed Security Patch to Fix Heartbleed Bug in OpenSSL

LiteSpeed Security Patch to Fix Heartbleed Bug in OpenSSL

LiteSpeed Web Server 4.2.9 was released this morning as a security patch to address the OpenSSL Heartbleed bug.

As noted on Heartbleed.com (the site Codenomicon has set up to explain the Heartbleed bug):

The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. SSL/TLS provides communication security and privacy over the Internet for applications such as web, email, instant messaging (IM) and some virtual private networks (VPNs).

This vulnerability should affect versions 4.2.5-8 and 5.0 RC1. If you use one of these versions, we highly recommend you upgrade to LSWS 4.2.9 as soon as possible.

The easiest way to upgrade is by using the lsup command: /usr/local/lsws/admin/misc/lsup.sh -f -v 4.2.9

Some users have experienced an issue with the lsup command that causes it to try to download from the wrong address. This can be fixed by removing your /usr/local/lsws/autoupdate/release file. Please let us know through our forum if you run into any other issues.

Tags: anti-hacking

Categories:LiteSpeed Web Server , Security

Comments

TechNil April 25th, 2014
Are you people also effected by heart bleed? 🙁
Reply
- Michael April 25th, 2014
  We were definitely susceptible, just like every other site on the Internet that used OpenSSL with those versions. (And this does not just include sites using Apache, LSWS, or nginx as their web server: http://www.troyhunt.com/2014/04/everything-you-need-to-know-about.html )
  Were we affected is a harder question. We have not seen any directly attributable effects, but, as the Heartbleed bug leaves no traces, we may never know.
  Reply
ie April 24th, 2014
If I don’t use any SSL in all my website, is it a concern?
Reply
- Michael April 25th, 2014
  Nope. If you actually use no SSL, then there’s no way for the bug to affect you. I would be very careful, though, before jumping to the conclusion that you use no SSL.
  Michael
  Reply
  - ie April 25th, 2014
    I have cPanel which use SSL but I already update OpenSSL on OS level
    Why you say need to be “very careful before jumping to the conclusion that you use no SSL.”. I use LiteSpeed & none my hosted website use “https://”, all only use http://
    Reply
SAJID April 19th, 2014
I hope it doesnt effect litespeed servers… I am really worried about this stupid heartbleed bug
Reply
- Michael April 21st, 2014
  Hi Sajid,
  As noted in the blog post above, the Heartbleed bug affects LSWS versions 4.2.5 – 4.2.8. If you have one of those versions, you should upgrade to 4.2.9 immediately.
  Cheers,
  Michael
  Reply
masabs April 8th, 2014
I’m using litespeed cpanel plugin. Can I use above command for updating this? latest version that available in WHM is 4,2,8.
Reply
- masabs April 8th, 2014
  Yes, it’s working for me….
  Reply
- Michael April 8th, 2014
  Just to confirm: Yes, the lsup command works no matter what control panel you may be using.
  4.2.9 won’t come up as an option for upgrading until your server has communicated with our licensing server to find out if there are new versions. This process happens automatically once per day.
  Cheers,
  Michael
  Reply
- itaylorjay April 10th, 2014
  I found that by first upgrading to 4.2.8 – the option of 4.2.9 came available.
  I was able to do it all through the cPanel Plugin interface
  Reply