5

I am currently having Bitcoin daemon version 0.9.0 and bitcoind getinfo shows error like "Upgrade required"

{ "version" : 90000, ... "errors" : "URGENT: Upgrade required: see https://www.bitcoin.org/heartbleed" }

How to upgrade Bitcoin daemon in ubuntu 12.04 and want to know daemon is sync blocks once again needed?

2

Update

The Ubuntu PPA has been updated with packages for Bitcoin Core 0.9.1. Ironically, they make the upgrade warning go away, but they do not fix the problem!

The Bitcoin Core packages for Ubuntu do not include a dependency on a fixed version of the OpenSSL libraries. Therefore, if you have not upgraded OpenSSL on your Ubuntu system, you will still be able to install the Bitcoin Core 0.9.1 packages. It runs just fine, and displays no warnings, yet is still vulnerable.

So upgrading to the Bitcoin Core 0.9.1 packages is neither necessary nor sufficient to remove the vulnerability. The one and only thing to do is to upgrade OpenSSL, and then (other than the warning message) it does not matter whether you use 0.9.0 or 0.9.1. Bitcoin 0.9.1 has absolutely no functional changes versus 0.9.0 (I diffed the sources).

To summarize:

  • Bitcoin 0.9.1, new OpenSSL: Not vulnerable, no warning

  • Bitcoin 0.9.0, new OpenSSL: Not vulnerable, displays warning

  • Bitcoin 0.9.1, old OpenSSL: Vulnerable, no warning

  • Bitcoin 0.9.0, old OpenSSL: Vulnerable, displays warning.

I will try to find the proper place to report this as a bug.

Previous discussion

The Heartbleed bug is not in bitcoind itself, but in the OpenSSL system library on which it depends. The bug is "fixed" in Bitcoin Core 0.9.1, but all they did was to require the use of OpenSSL 1.0.1g, which incorporates the actual fix.

However, Ubuntu has not updated their distributed version of OpenSSL to 1.0.1g; instead, they have patched the version that they are using. The patched version is 1.0.1-4ubuntu5.12. Ubuntu's security advisory is posted at http://www.ubuntu.com/usn/usn-2165-1/.

Possibly as a result of this, Ubuntu packages for Bitcoin Core 0.9.1 have apparently not been created; but if you upgrade your OpenSSL libraries, it is not necessary to upgrade Bitcoin Core.

If you have the precise-security repository in your software sources (or in /etc/apt/sources.list), all you need to do is install the updates as you normally would, using either the update manager or aptitude update; aptitude upgrade. If you have unattended upgrades enabled, this has probably happened already. You can check the installed version by running dpkg -l libssl1.0.0.

Once this is done, you should restart bitcoind. (In fact, if possible you should probably reboot the system, to ensure that other potentially vulnerable services are also restarted.)

In general, upgrading Bitcoin Core does not require you to re-download the block chain.

  • I did all you wrote, but bitcoind still reports an error: "URGENT: Upgrade required: see bitcoin.org/heartbleed" – Hubert Schölnast Apr 18 '14 at 15:40
  • The warning will still appear since it only checks the version number of Bitcoin Core, but once OpenSSL is upgraded, the warning can be ignored. – Nate Eldredge Apr 18 '14 at 15:44
  • "Error", "URGENT" - Does not sound like a harmless warning that can be ignored. To me this sounds as if bitcoind had detected a really grievous and serious problem. I wish there was a package for version 0.9.1 for Ubuntu 12.04. – Hubert Schölnast Apr 18 '14 at 17:23
  • Nate, why should I trust you more than the error message? – Hubert Schölnast Apr 19 '14 at 7:39
  • @Hubert: All of this software is open source; you can verify that all the changes made are as I have said, and I would encourage you to do so rather than taking my word. Other options include finding another way to upgrade, or to stop using Bitcoin for a while, or find another client you trust more. – Nate Eldredge Apr 19 '14 at 13:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.