[#65451] [ruby-trunk - Feature #10333] [PATCH 3/1] optimize: "yoda literal" == string — ko1@...
Issue #10333 has been updated by Koichi Sasada.
9 messages
2014/10/07
[#65458] Re: [ruby-trunk - Feature #10333] [PATCH 3/1] optimize: "yoda literal" == string
— Eric Wong <normalperson@...>
2014/10/07
[email protected] wrote:
[#65502] Re: [ruby-trunk - Feature #10333] [PATCH 3/1] optimize: "yoda literal" == string
— Eric Wong <normalperson@...>
2014/10/08
Eric Wong <[email protected]> wrote:
[#65538] Re: [ruby-trunk - Feature #10333] [PATCH 3/1] optimize: "yoda literal" == string
— Eric Wong <normalperson@...>
2014/10/09
Eric Wong <[email protected]> wrote:
[#65549] Re: [ruby-trunk - Feature #10333] [PATCH 3/1] optimize: "yoda literal" == string
— SASADA Koichi <ko1@...>
2014/10/09
On 2014/10/09 11:04, Eric Wong wrote:
[#65551] Re: [ruby-trunk - Feature #10333] [PATCH 3/1] optimize: "yoda literal" == string
— Eric Wong <normalperson@...>
2014/10/09
SASADA Koichi <[email protected]> wrote:
[#65453] [ruby-trunk - Feature #10328] [PATCH] make OPT_SUPPORT_JOKE a proper VM option — ko1@...
Issue #10328 has been updated by Koichi Sasada.
3 messages
2014/10/07
[#65559] is there a name for this? — Xavier Noria <fxn@...>
When describing stuff about constants (working in their guide), you often
7 messages
2014/10/09
[#65560] Re: is there a name for this?
— Nobuyoshi Nakada <nobu@...>
2014/10/09
On 2014/10/09 20:41, Xavier Noria wrote:
[#65561] Re: is there a name for this?
— Xavier Noria <fxn@...>
2014/10/09
On Thu, Oct 9, 2014 at 1:59 PM, Nobuyoshi Nakada <[email protected]> wrote:
[#65566] [ruby-trunk - Feature #10351] [Open] [PATCH] prevent CVE-2014-6277 — shyouhei@...
Issue #10351 has been reported by Shyouhei Urabe.
3 messages
2014/10/09
[#65741] Re: [ruby-cvs:55121] normal:r47971 (trunk): test/ruby/test_rubyoptions.rb: fix race — Nobuyoshi Nakada <nobu@...>
On 2014/10/16 10:10, [email protected] wrote:
5 messages
2014/10/16
[#65742] Re: [ruby-cvs:55121] normal:r47971 (trunk): test/ruby/test_rubyoptions.rb: fix race
— Eric Wong <normalperson@...>
2014/10/16
Nobuyoshi Nakada <[email protected]> wrote:
[#65750] Re: [ruby-cvs:55121] normal:r47971 (trunk): test/ruby/test_rubyoptions.rb: fix race
— Tanaka Akira <akr@...>
2014/10/16
2014-10-16 12:48 GMT+09:00 Eric Wong <[email protected]>:
[#65753] [ruby-trunk - Feature #10333] [PATCH 3/1] optimize: "yoda literal" == string — ko1@...
Issue #10333 has been updated by Koichi Sasada.
3 messages
2014/10/16
[#65818] [ruby-trunk - Feature #10351] [PATCH] prevent CVE-2014-6277 — shyouhei@...
Issue #10351 has been updated by Shyouhei Urabe.
3 messages
2014/10/20
[ruby-core:65711] [ruby-trunk - Bug #9424] ruby 1.9 & 2.x has insecure SSL/TLS client defaults
From:
stephen@...
Date:
2014-10-14 21:13:08 UTC
List:
ruby-core #65711
Issue #9424 has been updated by Stephen Touset.
This patch looks broken.
:options =3D> -> {
opts =3D =E2=80=A6
opts |=3D OpenSSL::SSL::OP_NO_SSLv3 if defined?(OpenSSL::SSL::OP_NO_SSLv=
3)
}.call
If that last constant isn't defined, the lambda will return nil and no opti=
ons will be overridden.
----------------------------------------
Bug #9424: ruby 1.9 & 2.x has insecure SSL/TLS client defaults=20
https://bugs.ruby-lang.org/issues/9424#change-49441
* Author: Jeff Hodges
* Status: Closed
* Priority: Normal
* Assignee: Martin Bosslet
* Category: ext/openssl
* Target version: current: 2.2.0
* ruby -v: -
* Backport: 1.9.3: UNKNOWN, 2.0.0: UNKNOWN, 2.1: UNKNOWN
----------------------------------------
Ruby 1.9, 2.0, and 2.1 use insecure defaults for SSL/TLS client connections=
. They have inherited or overridden configs that make the OpenSSL-controlle=
d connections insecure. Note: both OpenSSL's and Ruby's defaults in all tes=
ted versions are currently insecure. Confirmation of the issues with Ruby's=
TLS client can be done with the code in [1].
Ruby is using TLS compression by default. This opens Ruby clients to the CR=
IME attack[2].
Ruby also uses a variety of insecure cipher suites. These cipher suites eit=
her use key sizes much smaller than the currently recommended size, making =
brute forcing a decryption easy, or do not check the veracity of the server=
's certificate making them susceptible to man-in-the-middle attacks[3][4].
Ruby also appears to allow SSLv2 connections by default. It does so by firs=
t trying to connect with a SSLv2 client hello with a higher SSL/TLS version=
inside of it which allows SSLv2 servers to work. SSLv2 was broken in the 1=
990s and is considered unsafe.
These issues expose Ruby users to attacks that have been known for many yea=
rs, and are trivial to discover. These defaults are often build specific, a=
nd are not the same across platforms, but are consistently poor (the code i=
n [1] can evaluate the build). A patch from a core developer on the securit=
y@ list is attached. However, the patch does not correct the suspect SSLv2 =
configuration. It is believed that Ruby 1.8 is also a concern, but, since i=
t was obsoleted, it's not been investigated.
A report similar to this was sent to [email protected] four days ago. =
The Ruby core developers have been unable to patch these problems in a time=
ly manner for it for what I and others believe are concerning reasons. This=
ticket is being made to allow engineers outside of the small group that ar=
e on security@ to protect themselves from these attacks.
[1] https://gist.github.com/cscotta/8302049
[2] https://www.howsmyssl.com/s/about.html#tls-compression
[3] https://www.howsmyssl.com/s/about.html#insecure-cipher-suites
[4] TLS_DHE_DSS_WITH_DES_CBC_SHA - small keys
TLS_DHE_RSA_WITH_DES_CBC_SHA - small keys
TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA - MITM
TLS_ECDH_anon_WITH_AES_128_CBC_SHA - MITM
TLS_ECDH_anon_WITH_AES_256_CBC_SHA - MITM
TLS_ECDH_anon_WITH_RC4_128_SHA - MITM
TLS_RSA_WITH_DES_CBC_SHA - small keys
TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA - MITM
TLS_SRP_SHA_WITH_AES_128_CBC_SHA - MITM
TLS_SRP_SHA_WITH_AES_256_CBC_SHA - MITM
---Files--------------------------------
ruby_ssl.patch (1.08 KB)
change_ssl_defaults.diff (1.24 KB)
change_ssl_defaults.2.diff (2.13 KB)
--=20
https://bugs.ruby-lang.org/
