From: "NAKAMURA, Hiroshi" <nakahiro@...>
Date: 2007-10-04T22:33:05+09:00
Subject: Re: Ruby 1.8.6-p111 / 1.8.5-p114 released (Security Fix)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

Urabe Shyouhei wrote:
> A problem on the net/https library was reported. We already fixed that
> on the repository, but we also think it worth releasing. Here they are.
> The only difference with the latest 1.8.6-p110 / 1.8.5-p113 is the
> inclusion of fixes to it.
> 
> Detailed information should be found at the original advisory:
> http://www.isecpartners.com/advisories/2007-006-rubyssl.txt

It's not related to ruby but the report above should have a reference to
RFC2818 3.1. Server Identity.

RFC2818 said:

   Automated
   clients MUST log the error to an appropriate audit log (if available)
   and SHOULD terminate the connection (with a bad certificate error).

So net/http.rb versions on 1.8.6 and 1.8.5 SHOULD have
  @enable_post_connection_check = true
as well as a trunk version.  I recommend turning it on as soon as
possible although it's your business, syouhei.  Balance security and
compatibility.

For users: the problem affects if;
 1. code of your program or one of depending libraries is using
    net/https for SSL connection, plus,
 2. the code sets http.verify_mode to OpenSSL::SSL::VERIFY_PEER
    explicitly (VERIFY_NONE, which means no security, by default), plus,
 3. the code sets http.ca_file properly.

open-uri.rb is not affected on this because it does check server
identity though it does 2 and 3.  imap.rb, smtp.rb, pop.rb, drb/ssl.rb
will be fixed soon.

Regards,
// NaHi

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Cygwin)

iQEVAwUBRwTrbB9L2jg5EEGlAQKrvggAwsB0AwpTuL0enc9UtUhLBhvKDIUwr6eu
L5kAKxYn2CXH/r9AJY8F/fHT2jUeciIsnorkDwUIx+sHib2X2lo0XUWCqflusijb
h1g7rSVVBlKEX3wvfgugWkbZjd17dFj3Z12D+oLxZHi2La0dwJdFe8UgQ1+POf6l
iODrWKshN8d4olf9v++4LE49kUEnt/OGXMNMLENvwV3HnBGO8qtD/S85hjjIGZnV
8JerSBziCffJGglE7+xozElfs23HZW4gBjoLCVanK0slEHzO0GmY94P6DGLO4VhW
YCPP7M+1Nq+3fJPSXlT56SkcqyfWIcABpEKM+puUPD7dotFwqt8VXw==
=nu+h
-----END PGP SIGNATURE-----