Verify OpenVPN is no longer vulnerable to Heartbleed

Solution 1:

Let's follow the trail! What does openvpn use?

$ ldd $(which openvpn)
...
libssl.so.1.0.0 => /lib/x86_64-linux-gnu/libssl.so.1.0.0 (0x00007f464d630000)

OK, it's using libssl.1.0.0 provided by...?

$ dpkg -S /lib/x86_64-linux-gnu/libssl.so.1.0.0
libssl1.0.0:amd64: /lib/x86_64-linux-gnu/libssl.so.1.0.0

... provided by libssl1.0.0:

$ apt-get changelog libssl1.0.0 | grep -B10 CVE-2014-0160

openssl (1.0.1-4ubuntu5.12) precise-security; urgency=medium

  * SECURITY UPDATE: side-channel attack on Montgomery ladder implementation
    - debian/patches/CVE-2014-0076.patch: add and use constant time swap in
      crypto/bn/bn.h, crypto/bn/bn_lib.c, crypto/ec/ec2_mult.c,
      util/libeay.num.
    - CVE-2014-0076
  * SECURITY UPDATE: memory disclosure in TLS heartbeat extension
    - debian/patches/CVE-2014-0160.patch: use correct lengths in
      ssl/d1_both.c, ssl/t1_lib.c.
    - CVE-2014-0160

Looks good to me.