title: How to fix heartbleed without apt-get upgrading everything?
body: <p>I ran <code>apt-get install openssl</code></p>
  
  <p>and verified that the new version .1g is installed</p>
  
  <pre><code>root@nyc2-04-www:~# apt-cache policy openssl
  openssl:
    Installed: 1.0.1g-1
    Candidate: 1.0.1g-2
    Version table:
       1.0.1g-2 0
          500 http://http.debian.net/debian/ sid/main amd64 Packages
   *** 1.0.1g-1 0
          100 /var/lib/dpkg/status
       1.0.1e-2+deb7u6 0
          500 http://security.debian.org/ wheezy/updates/main amd64 Packages
       1.0.1e-2+deb7u4 0
          500 http://ftp.us.debian.org/debian/ wheezy/main amd64 Packages
          500 http://http.debian.net/debian/ wheezy/main amd64 Packages
  </code></pre>
  
  <p>However, I notice that even though the new openssl is installed, my servers are still vulnerable unless I do a full <code>apt-get upgrade</code></p>
  
  <p>See here:  <a href="http://filippo.io/Heartbleed/#www.uat.phantomjscloud.com" rel="nofollow">http://filippo.io/Heartbleed/#www.uat.phantomjscloud.com</a></p>
  
  <p>How can I avoid doing the full apt-get upgrade, but ensure the new openssl is being used?</p>
  
  <p>FYI I did verify that doing  <code>apt-get upgrade</code> will fix heartbleed (i did that in my production server)  But I'm currious as to why updating openssl isn't good enough.</p>
  
  <p>FYI I am using nginx.  I also did <code>apt-get install nginx</code> afterwards but that didn't resolve the issue either</p>
  
  <p>UPDATE:  running <code>openssl version -a</code> shows that <strong>1.0.1f</strong> is still active, even after reboot.</p>